DevKit DossierCheck your SBOM
An SBOM is the list of components inside your software. From 11 December 2027 the Cyber Resilience Act asks you to keep one for each product you ship, at the very least for its top-level dependencies. Upload yours and see what it says and what it leaves out.
What the check counts
- The seven data fields of the NTIA minimum elements: supplier name, component name, version of the component, other unique identifiers, dependency relationship, author of SBOM data and timestamp.
- Whether the file names your product and states its top-level dependencies.
- How many components can be matched against public vulnerability data, and how many cannot.
What happens to your file
The file is read in memory on our servers in the EU, counted and discarded. We do not store it and we pass nothing in it on to anyone else. Apart from the access log every request leaves (kept 30 days), we keep only counts per day: how many files were checked, how many could not be read and, as for every page of this site, how many times the page was viewed.
No SBOM at hand? See an example report.
Not sure what the CRA asks of an SBOM? Read the guide.
The report counts what the file contains. It is not a statement of conformity and it is not legal advice.