ScanCode.io
7.0#3 in open source license compliance softwareFree planFree planWebAPILinuxmacOS
VisitScanCode.io vs SW360
What both publish
| Fact | ScanCode.io | SW360 |
|---|---|---|
| Deployment | ScanCode.io can run in a Docker container or be installed on a Linux server. | The recommended SW360 v20 deployment uses containers compatible with Docker or Podman and includes the frontend, Keycloak, CouchDB, and Spring Boot backend. |
| Founded | 2014 | 2016 |
| License | The ScanCode.io software is licensed under Apache License 2.0. | The project is open source and licensed under EPL-2.0. |
| Purpose | ScanCode.io provides a Web UI and API for running and reviewing complex software composition analysis scans in scripted pipelines. | SW360 is a software catalogue and repository for collecting, organizing, and sharing information about software components used in an organization. |
| SBOMs | It supports generating and consuming CycloneDX and SPDX SBOMs. | The user guide lists Software Bill of Materials management as a use case. |
| Security configuration | Authentication for the Web UI and REST API is disabled by default and can be enabled with SCANCODEIO_REQUIRE_AUTHENTICATION. | The security guide recommends TLS with trusted certificates, secret management, and restricting bearer-token validation to trusted issuers. |
ScanCode.io plans
- ScanCode.io (Apache-2.0 software)Free
SW360 plans
- SW360Free
Pick ScanCode.io if…
ScanCode.io suits teams automating software composition analysis in CI/CD pipelines or reviewing software packages and containers. It is a fit for users able to run Docker or install it on a Linux server, including those who need an offline deployment.
Pick SW360 if…
SW360 suits organizations that need to track software components and license obligations across projects or products. Its listed audiences include quality managers, developers, legal counsels, software architects, and R&D managers.