docs

SBOM Inventory

This is the help text the console shows in the help panel on this page.

A Software Bill of Materials (SBOM) is a list of the open-source and third-party components your software depends on. Upload a dependency manifest and AutoCISO lists its components and matches them against known vulnerabilities. Supply Chain is available on The Growth plan or higher.

Why Maintain an SBOM Inventory?

  • Supply Chain Visibility: Know exactly what’s inside your software, including transitive dependencies listed in the manifest.
  • Continuous Monitoring: AutoCISO re-checks your inventory against the NVD and Red Hat vulnerability feeds every night, with no re-upload needed.
  • One place for results: The four cards at the top show open findings by severity (Critical, High, Medium, Low) across all your SBOMs.

Managing Your Inventory

  • Upload Manifest: Click Upload Manifest, choose a file, enter an SBOM name and an optional version. Accepted files: go.sum, pom.xml, build.gradle / build.gradle.kts, package.json, requirements.txt (max 5 MB). The file name decides how it is parsed. CycloneDX and SPDX documents are not accepted.
  • Table: Name, Version, Findings (C / H / M / L counts) and Last Scanned. Use the search box to filter by name.
  • Details: Click a row to see the SBOM’s components (name, version, ecosystem, PURL) and its findings.
  • Delete: The trash icon deletes the SBOM together with its components and findings. This cannot be undone.

CI/CD Integration

Automate uploads from your build pipeline: push the dependency manifest of each service on every build.

API Token: Create a dedicated token with the sbom:write scope from the user menu → API Tokens and store it as a CI/CD secret.

curl

curl -X POST 'https://api.autociso.io/api/v1/sscs/sboms/upload' \
    -H 'Authorization: Bearer aci_...' \
    -F 'file=@/path/to/build.gradle' \
    -F 'name=my-org/my-service' \
    -F 'version=1.0.0'

GitHub Actions

- name: Upload SBOM to AutoCISO
  run: |
    curl -X POST 'https://api.autociso.io/api/v1/sscs/sboms/upload' \
      -H 'Authorization: Bearer ${{ secrets.AUTOCISO_API_TOKEN }}' \
      -F 'file=@build.gradle' \
      -F 'name=${{ github.repository }}' \
      -F 'version=${{ github.ref_name }}'

Store the token as AUTOCISO_API_TOKEN in Settings → Secrets and variables → Actions.

GitLab CI

upload-sbom:
  stage: security
  script:
    - |
      curl -X POST 'https://api.autociso.io/api/v1/sscs/sboms/upload' \
        -H "Authorization: Bearer $AUTOCISO_API_TOKEN" \
        -F 'file=@build.gradle' \
        -F "name=$CI_PROJECT_PATH" \
        -F "version=$CI_COMMIT_REF_NAME"

Store the token as AUTOCISO_API_TOKEN in Settings → CI/CD → Variables (masked, protected).

Last reviewed: 2026-10-10

Was this page helpful?

Esc