Applications from an SBOM

For programs that aren't on GitHub (a hosted line-of-business app, a vendor-supplied web application, an internal tool), upload an SBOM (software bill of materials). RevoSecure matches its components against vulnerability data and rescans them every day.

Add an application

1. In the customer's Code & apps, choose Add application (SBOM).
2. Name the application.
3. Upload its SBOM. The application is scanned straight away.

Accepted formats

Up to 10 MB:

• CycloneDX JSON ("bomFormat": "CycloneDX"), including nested components;
• SPDX 2.2 or 2.3 JSON ("spdxVersion"), using package URLs from externalRefs.

SPDX 3 (JSON-LD) isn't supported yet. Components without a package URL (purl) are counted but can't be checked.

Generate an SBOM

Generate it from what actually runs: the deployed folder, build output or container image.

# Syft: any language, folders or container images
syft dir:. -o cyclonedx-json > bom.json

# cdxgen: most languages
cdxgen -o bom.json

# npm 9.5 or later
npm sbom --sbom-format cyclonedx > bom.json

# .NET
dotnet tool install --global CycloneDX
dotnet CycloneDX MyApp.sln -j -o .

Keep it current

Each upload replaces the previous component list and triggers a scan. Upload a new SBOM after each release, or the results describe an old version.

Turning Monitor daily off drops the stored components and resolves the application's vulnerabilities. Turning it back on leaves the application waiting for a new SBOM; uploading one resumes monitoring.

See Code and applications for how results and findings work.