An SBOM records detected components and versions. An SCA audit relates that inventory to vulnerability sources and policy thresholds. Neither result alone proves that a release is safe; a professional security owner must review reachability, fixes, exceptions, and freshness.
Generate the inventory
python -m src.cli sbom generate --project <project> --format cyclonedx --output <sbom.json>
The current format choices are --format {cyclonedx,spdx}. Retain the project revision, command,
output file, and digest with the SBOM.
Audit vulnerabilities
python -m src.cli sbom audit `
--project <project> `
--format sarif `
--fail-on high `
--output <sca.sarif>
Audit choices are --format {sarif,json,markdown,gost} and
--fail-on {critical,high,medium,low}. The exit threshold is an operational CI policy, not a
replacement for governed product acceptance.
Use sbom sync under the approved network policy to refresh vulnerability data. Record source
and timestamp so that later reviewers can distinguish a clean scan from a stale cache.
REST and dashboard
Project-scoped SCA operations are under /api/v1/security/sca. Consult the generated REST
reference for the exact live operation and schema instead of copying route lists from this guide.
Triage
- Confirm package name, version, ecosystem, and dependency path.
- Check advisory source and cache freshness.
- Assess whether the vulnerable code is reachable in the deployed profile.
- Prefer an upgrade or removal; document compensating controls and expiry for exceptions.
- Regenerate both SBOM and audit evidence after remediation.
Contract sources
src/cli/security_suite/sbom_commands.py— CLI parser;src/sca/— inventory, advisory, and reporting implementation;src/api/routers/security_suite/— live project-scoped SCA routes;scripts/validate_sca_sbom_docs.py— documentation/source contract validator.