Supply Chain Security
Know every
component.
Automatic Software Bill of Materials from every scan. Know exactly what's in your software — every dependency, every license, every risk.
Regulatory compliance requires it. Supply chain attacks demand it. codelake generates SBOMs automatically, in standard formats, ready for submission.
$ codelake sbom --format cyclonedx
▸ Generating SBOM for acme-api...
Scanning 4 package managers
Resolving transitive dependencies...
Components: 342 total
Direct: 47 · Transitive: 295
Vulnerabilities: 12 CVEs detected
Critical: 1 · High: 3 · Medium: 5 · Low: 3
Licenses: 2 copyleft detected
MIT: 287 · Apache-2.0: 41 · GPL-3.0: 2
✓ SBOM exported · sbom-acme-api-v3.2.1.json
█Export Formats
Industry-standard formats. Ready for submission.
Export your SBOM in the formats your customers, regulators, and partners require. Full compliance with NTIA minimum elements.
CycloneDX
OWASP Standard · JSON / XML
The lightweight SBOM standard designed for security use cases. Includes vulnerability data, license info, and component provenance. Supported in versions 1.4, 1.5, and 1.6.
- ✓ Vulnerability cross-references (VEX)
- ✓ License expressions
- ✓ Dependency graph included
- ✓ Machine-readable for automation
SPDX
Linux Foundation · JSON / RDF / Tag-Value
The ISO/IEC 5962:2021 standard for software composition. Recognized by governments and enterprises worldwide. Full support for SPDX 2.3 and 3.0.
- ✓ ISO-standardized format
- ✓ SPDX license identifiers
- ✓ Package verification codes
- ✓ Government procurement compatible
Regulatory Compliance
Meet the regulations that require SBOMs.
SBOM requirements are no longer optional. From the EU Cyber Resilience Act to the US Executive Order on cybersecurity, software transparency is mandated.
EU Cyber Resilience Act (CRA)
The EU CRA requires manufacturers of products with digital elements to provide SBOMs and demonstrate vulnerability handling processes. Non-compliance carries fines up to 15M EUR or 2.5% of global turnover.
- ✓ Machine-readable SBOM in CycloneDX or SPDX
- ✓ Vulnerability disclosure and handling evidence
- ✓ Security update documentation
- ✓ Component provenance tracking
US Executive Order 14028
EO 14028 requires SBOM provision for all software sold to the US federal government. NTIA minimum elements must be included: supplier, component name, version, unique identifiers, dependency relationships, and timestamps.
- ✓ NTIA minimum elements compliance
- ✓ Unique identifiers (CPE, PURL) for every component
- ✓ Dependency relationship mapping
- ✓ Timestamp and authorship metadata
Dependency Graph
Visualize your entire dependency tree.
See every direct and transitive dependency in an interactive graph. Spot vulnerable paths, license risks, unmaintained packages, and dependency confusion attacks at a glance.
-
account_tree
Interactive Dependency Tree
Expand and collapse dependency paths. Click any node to see version, license, CVEs, and maintenance status.
-
bug_report
Vulnerability Highlighting
Vulnerable components are highlighted red with CVE details. See exactly which transitive path introduces the risk.
-
warning
Transitive Dependency Risk
Your direct dependencies are only half the story. codelake traces the full transitive tree to find risks buried 4-5 levels deep.
-
content_copy
Dependency Confusion Detection
Detect packages that could be subject to dependency confusion or typosquatting attacks. Verify package source registries.
License Compliance
Know every license in your stack.
License violations can be as costly as security breaches. codelake classifies every dependency license, flags copyleft risks, and alerts on incompatible combinations.
Permissive
328
MIT, Apache-2.0, BSD, ISC
Weak Copyleft
9
LGPL, MPL, EPL
Strong Copyleft
2
GPL-3.0, AGPL-3.0
Unknown
3
No license file detected
License Policy Engine
Define which license types are allowed in your projects. Block builds that introduce copyleft dependencies, require approval for unknown licenses, or auto-approve permissive ones. Enforce per-project or organization-wide.
Know exactly what's in your software.
codelake generates SBOMs automatically from every scan. CycloneDX, SPDX, dependency graphs, license compliance — everything you need for regulatory requirements and supply chain security.