Product guide · English
Secure your supply chain
Create a versioned inventory, review its advisory coverage, and evaluate policy against the declared release before recording VEX decisions or comparing inventories.
Steps
- Open the repository’s Dependencies area or Supply chain. Save an SBOM from a completed audit or upload a supported CycloneDX or SPDX document with its product, release and commit identity.
- Inspect package identities, licenses, advisory results and completeness warnings. Refresh advisory evidence when it is stale.
- Evaluate the applicable package, license and vulnerability policies. Record a VEX decision only when you have evidence about whether the vulnerability affects this artifact; every decision needs a reviewed impact statement, and a machine-readable justification is optional.
- Compare against another inventory of the same repository/product to review added or removed package identities and license changes. Export an SBOM or VEX when you need to share the relevant evidence.
Read the result
Inventories describe declared components for a specific release; they do not prove what is deployed. Missing, stale or incomplete advisory evidence cannot establish safety. A dependency path is structural evidence, not proof of runtime reachability or unreachability.
Limits and availability
Imports support bounded profiles of CycloneDX and SPDX, not every semantic feature or a lossless round trip. The importer does not execute builds or resolve arbitrary external references. Policy and VEX decisions remain tied to their scope; exceptions do not supply missing evidence.
This guide describes the implemented workflow. The features available in your workspace depend on account capabilities and configuration; advanced workflows are not all included in Free Quick Scan. Check the available controls and the evidence returned by each run.