Building in the open
Vulnerability review
SBOMFlow checks what your release contains against vulnerability advisories, offline, and adds the context a reviewer needs: whether a vulnerability is known to be exploited, how likely exploitation is, and whether the vulnerable code looks reachable. Then a person decides, and that decision becomes the VEX you hand to customers.
What you get
Match against a local vulnerability snapshot you control, with OSV and NVD as explicit opt-ins. Each finding shows how confident the match is and where it came from. Out of the box it uses a clearly labelled sample feed, so nothing reads as real until you point it at real data.
CISA Known Exploited Vulnerabilities and FIRST EPSS scores arrive as labelled inputs for triage, with a suggested SSVC priority behind an opt-in flag. They inform a decision. They never make one.
For Python, JavaScript and TypeScript, Go, Rust and C/C++, the run notes whether it saw the vulnerable code referenced. “Not observed” never means safe, and it never closes a finding.
Your reviewers’ decisions are written out as OpenVEX, CycloneDX VEX and CSAF VEX. A “not affected” without a valid justification is downgraded, not accepted.
A supplier’s VEX statement is shown beside the finding it concerns. It never closes your finding for you, and where it disagrees with your reviewer, your reviewer’s decision stands.
Re-check a shipped release against a newer advisory snapshot and see what is newly affected, what no longer matches and what is unchanged. The shipped record itself is never changed.
Zero findings never means no vulnerability. Every ecosystem carries a statement of how well the advisory data covers it, so an ecosystem with unknown coverage never reads as clean. For a new advisory against many shipped releases at once, see post-market & PSIRT cases.
Try the boundary
Below is one sample finding exactly as far as the engine takes it. Record a decision and see what the record does with it, including the case where the answer is “no”.
The engine runs to the edge of a decision and then stops. It has no way to go further on its own — not a policy choice, a boundary. Everything below the line waits for a person.
CVE-SAMPLE-OPENSSL-001 in openssl 3.0.11the engine stops here
No decision has been made, and none will be. A reviewer records one — with their name on it.
Illustrative · sample advisory labelled non-real
(CVE-SAMPLE-*) · the buttons stand in for a recorded
reviewer decision
Compare what SBOMFlow observes with what your team decided last time, and see how those decisions read as a record. It runs offline on your own machine. v0.5.0 is available to approved private testers.