sbomify

Overview

sbomify brings software bills of materials and compliance evidence into a shared workflow, from generation and analysis to customer-facing distribution. It is best suited to software vendors assembling security evidence and software buyers verifying it. Its breadth is attractive, but the Community plan’s one-product, five-component ceiling and public-only documents make it more of a limited starting point than a private sharing solution.

Key features

Generation supports both CycloneDX and SPDX, across 17 ecosystems, container images, directory scans, and Yocto/OpenEmbedded builds. That range suits teams producing inventories from varied inputs; it is less compelling for buyers seeking a broader compliance tool, since sbomify does not provide license analysis.

For pipeline use, the sbomify Action supports GitHub, while Docker-based workflows are documented for GitLab, Bitbucket, and other CI/CD systems. Google OSV and OWASP Dependency-Track are available as vulnerability-analysis integrations. The combination supports security-focused SBOM workflows, though teams needing license review will need another tool for that work.

Trust Centers bring together SBOMs, VEX and CBOM artifacts, security certifications, penetration test reports, and compliance attestations. Custom domains and public or private access let teams choose how they share those materials. The Transparency Exchange API (TEA) also makes Trust Center content available programmatically, which suits organizations integrating artifact access into other systems.

sbomify can be used as a hosted service or self-hosted. That choice is useful for teams with different deployment preferences, while the Community plan’s public-only documents remain a constraint regardless of the appeal of the broader workflow.

Pricing

The Community plan is free and includes unlimited SBOMs and compliance documents, but caps accounts at one product, five components, and one user. Documents are public only. This is a narrow fit for an individual evaluating basic generation and sharing; the document count is generous, but the product and component limits quickly restrict ongoing work.

Business costs $159 a month, billed annually, and includes five products, 200 components, unlimited SBOMs and compliance documents, private documents, and a 14-day free trial. It is the practical tier for teams that need private customer-facing materials and room for multiple products. The annual billing term and single-user cap on Community mean the free option is not a like-for-like substitute.

Enterprise has custom pricing and includes unlimited products and components, SSO/SCIM, a dedicated account manager, and SLA-backed support. Its role-based access controls, audits, and organization-wide roles make it the better fit for organizations needing centralized access governance and support commitments. Business includes priority email support, but not those listed Enterprise controls.

Platforms

sbomify supports API, Linux, macOS, self-hosted, web, and Windows. Hosted and self-hosted deployment give teams a choice in how they operate the platform, with API access supporting programmatic use of Trust Center content.

Who it's for

Software vendors that need to generate SBOMs and assemble shareable compliance evidence are the clearest fit, especially when customer-facing Trust Centers and private documents matter. Software buyers verifying software asset security are also within the intended audience. Individual users or small teams can start with Community, but its single user, one product, five components, and public-only sharing impose real limits.

Pros and cons

• Pros: Supports both major SBOM formats and generation across varied ecosystems and inputs, reducing the need to constrain workflows to one source type.
• Pros: Trust Centers combine multiple kinds of security evidence with custom domains, access controls, and an API, making them useful for organized customer sharing.
• Pros: Hosted and self-hosted options accommodate different deployment preferences.
• Cons: Community restricts accounts to one user, one product, and five components, and permits only public documents, limiting its use for private or growing workflows.
• Cons: Business costs $159 a month, billed annually, to gain private documents, so secure sharing requires a substantial paid commitment.
• Cons: License analysis is not included, leaving teams that need it to add another tool or choose a different workflow.

Alternatives

For a broader comparison, browse SBOM Management Software.

Choose Sonatype Nexus Repository if you want its Community Edition’s full ecosystem support, CI/CD integration, and external PostgreSQL database option. Interlynk is worth considering if a community tier with no per-seat fees or per-SBOM metering better suits your budget priorities.

Ortelius offers a free option with up to five components, unlimited users, unlimited endpoint tracking, and community support; it may suit teams prioritizing those terms. CAST SBOM Manager is another option if a free download for Linux or Windows is the main requirement.

Exodos Labs has a Community plan with one user, one API key, unlimited inventories, and community support, making it a relevant alternative for inventory-focused needs. FOSSA may suit teams whose project and contributor counts fit its free plan’s five-project and ten-contributing-developer limits.

ReARM offers a free, self-hosted community edition for a single organization, with core SBOM/XBOM storage and retrieval. TRUSCA is an alternative with a free, self-hosted Apache-2.0 plan and no per-seat licensing.

Verdict

sbomify is a strong choice for software vendors that want SBOM generation, vulnerability-analysis integrations, and a customer-facing hub for security evidence, with hosted and self-hosted deployment options. Its decisive strength is bringing artifact creation and sharing together; its main drawbacks are the tightly constrained free plan, the annual Business commitment for private documents, and the absence of license analysis. Choose it when that integrated sharing workflow is central; look elsewhere if license review or a less limited free tier is essential.