Review an SBOM report
Open an SBOM report when you need the component inventory for a build, to explore component dependencies, to download or share that inventory, or to manage vulnerabilities detected in those components.
Find the report
- Open SBOMs for an organization-wide list, or open a project and then SBOMs.
- For SCM-backed projects, project SBOMs summarize the latest complete Build on the default branch. Open Builds and then a Build hub when you need SBOMs for another commit or branch. Generic projects show that project's uploaded SBOMs.
- Open the report you need.
On the organization Vulnerabilities page, the view icon on a finding also opens that finding's SBOM report.
Report Summary
The report summary includes repository or source context, component and language details, report status, roll-up counts for vulnerabilities and components, and actions for copying or downloading report data.
- When a component version is a long
sha256:digest, the summary card shortens the displayed hash. Hover the shortened value to see the full digest. - The Source badge opens the upstream repository when that URL is available. For GitHub and GitLab, it opens the specific branch or build when both the repository URL and build metadata are present. For Generic projects it uses the project URL when one is configured. If that metadata is missing, the badge is text only.
Components and Dependencies
Below the summary, the report has three tabs:
| Tab | Use it to |
|---|---|
| Vulnerabilities | Triage findings for this report. |
| Components | Browse the component inventory (name, type, version, vulnerability count, licenses). |
| Dependencies | Explore how components depend on each other. |
Use search, sort, Filter, and pagination in the table controls on Vulnerabilities and Components. Large reports load in pages rather than as one unbounded list.
Nested CycloneDX components
When the Platform ingests a CycloneDX SBOM — from a connected repository Build or a manual upload — it includes nested components: components listed under another component, at any depth. Nested components count toward the report summary and are linked to vulnerabilities the same way as other components.
On the Components tab, nested components appear as ordinary table rows (not an expand/collapse tree). The table defaults to showing only top-level components: open Filter and leave Hide nested components on. Turn the switch off when you need child rows. Use search, sort, and pagination to find a specific name or version among the visible rows.
Vulnerability mapping still includes nested components when they are hidden from the table. The report summary component count includes every component, including nested ones.
Hide file components
CycloneDX components with type file often add little license or version context. The Components table defaults to hiding them: open Filter and leave Hide file components on. Turn the switch off when you need those rows.
Vulnerability mapping still includes file components when they are hidden from the table. The report summary component count includes every component, including file types.
By default both Hide nested components and Hide file components are on, so the table starts with top-level, non-file rows.
Component licenses
The Licenses column on the Components tab shows each component's license labels from the SBOM. You can sort by that column from the table controls; components with no license data still appear in the sorted list.
RunSafe language SBOM generators (for example Python, JavaScript, Go, Ruby, Rust, or Java) include component license data when they create the SBOM, so the inventory is complete from the start. Manually uploaded SBOMs from other tools show only the license data those tools recorded.
If a license does not match a clean SPDX identifier, the table shows a label such as {component name} Non-SPDX License. Select the info icon next to that label to read the unmatched license text. These licenses are included when the Platform evaluates license policy.
Inspect dependency details from Components
On the Components tab, use the network action on a row when the component has recorded dependency relationships. That opens dependency details for the component: package URL when available, paths from a selected dependency root, and Open dependency explorer to jump to the Dependencies tab focused on that component. The network action is hidden when the component has no dependency-graph neighbors.
Explore the dependency graph
On the Dependencies tab:
- Choose a dependency root when more than one is available, or open the tab from a component's network action so the graph is focused on that component.
- Review the centered component and its direct dependencies and dependents.
- Select a neighbor to walk the graph, or search by name, version, or bom-ref.
- Use View all when a neighbor list is long.
Dependency relationships come from the SBOM's dependency data. Components without recorded relationships still appear in search and on the Components tab, but they do not show graph neighbors.
For large SBOMs, opening Dependencies without selecting a component first may show only the current Components page in the graph. Prefer the network action on a component row (or search to a specific bom-ref) so the Platform loads that component's neighborhood for the full report.
View Historical Reports
Use the report history selector on the report page to view older versions of an SBOM report. This is useful for understanding what vulnerabilities have been found since an SBOM was originally generated. You may notice gaps in the dates present in the dropdown. That is expected when no new vulnerabilities are discovered on a nightly rescan of the SBOM.
- Latest marks the most recent complete report.
- In Progress marks the latest report while vulnerability scanning is still running.
Retry a failed scan
- Open the failed report.
- If you are looking at an older failed report, select View latest report to return to the current report.
- If the latest report failed, select Retry scan.
- The page shows a scanning message and opens the new report after the retry starts.
If the failure persists, contact support@runsafesecurity.com.