Skip to content

Software Bill Of Materials (SBOM)

To access the SBOM service, select SBOM from the application's sidebar in the BoostSecurity dashboard. From the main SBOM view, the list of projects and their detected vulnerabilities, as well as the account-wide view, are provided.

SBOM Service

Account Summary

The first section of the SBOM view is the account summary. The overall number of vulnerabilities per level is provided, i.e., the overall number of vulnerabilities across all projects and third-party components in the account. The SBOM document can be downloaded in either Cyclonedx or Spdx format for the account, from the account summary. The account summary SBOM documents contain the inventory of all components across all projects in the account.

SBOM Account Wide view

Projects Specific Summary

The projects summary section provides a project's based posture, providing the number of vulnerabilities summary

  • Per severity level
  • Per project for all projects in the account

The project-specific SBOM document can be downloaded in either the Cylonedx or Spdx format for any project from that section.

SBOM per project view

The projects are presented in descending order of vulnerability severities.


The search area can be used to search for a project by name keyword across all projects in the account.


The Packages view provides a quick way to find all packages and third-party components included across all projects in the account.

SBOM Packages view

The packages are presented in decreasing order of number and severity of vulnerabilities. For each package, the following are provided:

  • The number and severity of vulnerabilities.
  • Number of repositories in the account, that includes the package.


The search area can be used to search for a package by name or vulnerability id.

Package Details

Further details about a package are displayed by selecting a particular package from the list of packages. Such details include:


The vulnerability details for each package can be viewed by selecting the Vulnerabilities tab. The list of vulnerabilities is presented, including the

Vulnerabilities Details

CVSS 3.1 and EPSS Score

By clicking on a particular vulnerability listed in the Vulnerabilities tab, the CVSS and EPSS scores can be viewed.


The vulnerabilities details view can be exited with "Esc" or by clicking the close (x) button.


Likewise, the list of repositories can be viewed by selecting the Repositories tab. The list of projects is presented.

Repositories Details

The project link can be selected from the list of projects, taking the user to the project-specific view.

No Packages Found

If no results are found based on selected filters, you will be notified that no vulnerable packages meet the criteria.

No packages found

Transitive Dependencies

Transitive dependencies occur when security vulnerabilities or issues are detected not directly within the project's code but within dependencies of a project's codebase forming a chain of interconnected components.

BoostSecurity analyzes dependencies and their associated vulnerabilities comprehensively and not only identify issues within the project's direct dependencies but also uncover vulnerabilities within transitive dependencies. By flagging these transitive dependencies, BoostSecurity provides an avenue for developers to prioritize and address security issues, thereby ensuring the integrity applications.

Transitive Filter

Transitive Details

Patch recommendations

For each vulnerability in a library, we display a link to the library's vulnerability details page. This page contains a list of all the versions of the library that are affected by the vulnerability. If a patch is available, it will specify the version of the library that contains the fix.


Data Update Cycle

Data sources are regularly refreshed to ensure the most up-to-date information is available for analysis and decision-making. Updates occur every 12 hours, maintaining the accuracy and relevance of the data provided to users.