SBOM

ELI5 — The Vibe Check

An SBOM (Software Bill of Materials) is a complete ingredient list for your software — every library, framework, and dependency with their exact versions. Like a nutrition label on food tells you what's inside, an SBOM tells you what's inside your app. When a vulnerability hits (like Log4Shell), an SBOM lets you instantly check 'are we affected?' instead of frantically grepping through repos at 2 AM.

Real Talk

A Software Bill of Materials (SBOM) is a machine-readable inventory of all software components, dependencies, and their relationships within an application. Standardized formats include SPDX and CycloneDX. SBOMs enable vulnerability tracking (cross-reference against CVE databases), license compliance, and supply chain risk assessment. Required by US Executive Order 14028 for federal software procurement. Generated by tools like Syft, Trivy, and GitHub's dependency graph.

When You'll Hear This

"Generate an SBOM before every release — it's required for enterprise clients." / "The SBOM showed we had 3 transitive dependencies affected by the CVE."