What's really inside the software you trust?
Every modern application is an iceberg. The code you write sits above the waterline — a thin layer atop hundreds, sometimes thousands, of transitive dependencies you never directly chose. Libraries depend on libraries that depend on libraries. Your "simple" web server pulls in 847 packages. Each one is a decision someone else made, a supply chain you inherited.
An SBOM is a structured inventory — a machine-readable file that catalogs every component in a piece of software. Think of it as a nutrition label for code.
{
"bomFormat": "CycloneDX",
"specVersion": "1.4",
"components": [
{
"type": "library",
"name": "log4j-core",
"version": "2.17.1",
"supplier": {
"name": "Apache Software Foundation"
},
"hashes": [{
"alg": "SHA-256",
"content": "3fa2cb543454..."
}],
"licenses": [{
"id": "Apache-2.0"
}]
}
]
}A single compromised dependency doesn't stay contained. Like a crack propagating through glass, a vulnerability in crypto-rng@0.9 flows upward — through jwt-lib, through auth-service, until your entire production application inherits the risk. The SBOM makes this chain visible before it becomes an incident.