Skip to main content

Review an SBOM report

Open an SBOM report when you need the component inventory for a build, to download or share that inventory, or to manage vulnerabilities detected in those components.

Find the report​

  1. Open SBOMs for an organization-wide list, or open a project and then SBOMs.
  2. GitHub and GitLab project views are scoped to the build you selected. You can change the build using the selector on the right side of the page. Generic projects show that project's uploaded SBOMs.
  3. Open the report you need.

On the organization Vulnerabilities page, the view icon on a finding also opens that finding's SBOM report.

Report Summary​

The report summary includes repository or source context, component and language details, report status, roll-up counts for vulnerabilities and components, and actions for copying or downloading report data.

  • When a component version is a long sha256: digest, the summary card shortens the displayed hash. Hover the shortened value to see the full digest.
  • The Source badge opens the upstream repository when that URL is available. For GitHub and GitLab, it opens the specific branch or build when both the repository URL and build metadata are present. For Generic projects it uses the project URL when one is configured. If that metadata is missing, the badge is text only.

View Historical Reports​

Use the report history selector on the report page to view older versions of an SBOM report. This is useful for understanding what vulnerabilities have been found since an SBOM was originally generated. You may notice gaps in the dates present in the dropdown. That is expected when no new vulnerabilities are discovered on a nightly rescan of the SBOM.

  • Latest marks the most recent complete report.
  • In Progress marks the latest report while vulnerability scanning is still running.

Retry a failed scan​

  1. Open the failed report.
  2. If you are looking at an older failed report, select View latest report to return to the current report.
  3. If the latest report failed, select Retry scan.
  4. The page shows a scanning message and opens the new report after the retry starts.

If the failure persists, contact [email protected].