Cyber Resilience Act

SBOM gap check

The Cyber Resilience Act requires a reliable software bill of materials (SBOM) and a process for handling vulnerabilities. Upload your SBOM (CycloneDX/SPDX) or a lockfile and we will scan its components against known vulnerabilities. Your file is processed for analysis only and is not stored.

Choose SBOM or lockfile

CycloneDX/SPDX JSON or a lockfile (package-lock.json, yarn.lock, requirements.txt, go.mod …). Max 5 MB. Your file is processed only temporarily and deleted afterwards.

The scan runs server-side against a vulnerability database. Your file is processed only temporarily for the analysis and deleted afterwards.

Flow of the SBOM check in three steps. 1 Upload a file: CycloneDX or SPDX JSON or a lockfile, for example package-lock.json, requirements.txt, go.mod or Cargo.lock, up to 5 MB. 2 Matching: the components are checked server-side against a public vulnerability database, the file is deleted afterwards. 3 Result: traffic light, vulnerabilities found with the top hits, and the matching CRA action areas. Below, what the CRA requires behind it: Annex I Part II(1), identify and document components and vulnerabilities, including an SBOM in a commonly used machine-readable format covering at least the top-level dependencies; Annex I Part II(2), address and remediate vulnerabilities without delay, including by providing security updates; Article 13(8), handle vulnerabilities effectively throughout the support period, an ongoing process rather than a one-off check. Footer: automated, schematic initial assessment based on public data, replaces neither a full security analysis nor legal advice. — The SBOM check in three steps and the CRA obligations it relates to.

Note: the SBOM gap check provides an automated, schematic initial assessment based on public vulnerability databases. It replaces neither a full security analysis nor individual legal advice.