Software Bill of Materials (SBOM)

A software bill of materials (SBOM) is a formal, machine-readable inventory of every component that makes up a piece of software — each open-source library, its exact version, and its license — much like an ingredients label on food. Modern apps pull in hundreds of transitive dependencies, and an SBOM makes that hidden supply chain explicit. Its value shows up when a vulnerability drops: when the next Log4Shell-style CVE lands, teams with an SBOM can answer "are we affected, and where?" in minutes by querying their inventory, instead of manually auditing every service. Standard formats are SPDX and CycloneDX, and tools generate an SBOM automatically from your dependency manifests. For AI/SaaS builders, SBOMs are increasingly required — by enterprise customers, security questionnaires, and regulation like the US executive order on software supply chains. Practical note: generate an SBOM in CI on every build so it stays current, and feed it into a scanner that alerts on known vulnerabilities and license conflicts, rather than treating the file as a one-time deliverable.