Sbom
Generates a CycloneDX 1.4 Software Bill of Materials from your lockfile — the artifact procurement and compliance teams ask for.
One of 122 modules in the GateTest scan suite. Catches the issue before it reaches code review, and on paid tiers opens a pull request with the fix already written.
SBOM generated: 214 components, 3 GPL-licensed, 1 EOL package flagged
Why we catch it
Catches the supply-chain takeovers, container exploits, and CI/CD foot-guns.
The Sbom module sits in this category alongside 6 related modules. Together they form one of the layers of a GateTest scan — checks fire in parallel, findings cluster by root cause, and on paid tiers the AI auto-fix loop reads each finding, writes the fix, validates against the scanner, and opens a PR.
How GateTest covers sbom
- Runs on every Full scan and above. Full ($99), Scan + Fix ($199) and Forensic ($399) — every repository tier except Quick ($29), which runs only 4 modules. No additional configuration.
- Free CLI.
npm i -g @gatetest/cli && gatetest --module sbomagainst any local repo. No paywall on the scanning itself. - AI auto-fix PR. Scan + Fix tier opens a pull request with the fix, a regression test, and a pair-review by a second AI reviewer. Forensic Scan tier adds per-finding diagnosis and cross-finding attack-chain correlation.
- Honest confidence rating. Findings come with high / medium / low confidence so noisy patterns don't block the gate. The confidence-calibrator trainer reads customer suppressions and tightens rules over time.
Scan your repo for sbom
Free preview of the headline findings. Pay per scan, not per seat — one-time scans never auto-renew.
Frequently asked questions
What does the Sbom module catch?
Generates a CycloneDX 1.4 Software Bill of Materials from your lockfile — the artifact procurement and compliance teams ask for. Example finding: SBOM generated: 214 components, 3 GPL-licensed, 1 EOL package flagged
Does GateTest fix Sbom issues automatically?
Yes — on the Scan + Fix tier ($199) and Forensic Scan tier ($399), the fix engine reads the finding, writes the fix, validates against the scanner, writes a regression test, and opens a pull request for your review.
Which tiers include the Sbom module?
Full ($99), Scan + Fix ($199) and Forensic ($399) — every repository tier except Quick ($29), which runs only 4 modules.
Can I run the Sbom module from the CLI for free?
Yes — install with `npm i -g @gatetest/cli` and run `gatetest --module sbom`. The local CLI is free; paid tiers add AI auto-fix and the cross-finding correlation work.