sbomify

Overview

sbomify combines software bill of materials (SBOM) production and management with a hub for sharing security and compliance evidence. It is a strong fit for software vendors preparing customer-facing documentation and buyers checking software security. Its main appeal is bringing those workflows together; the free plan’s single-product, public-only limits make it less suitable for teams that need private sharing without a budget.

Key features

Generation supports CycloneDX and SPDX, covering 17 ecosystems as well as container images, directory scans, and Yocto/OpenEmbedded builds. That breadth helps teams assemble inventories from varied software inputs. The sbomify Action supports GitHub, while Docker-based workflows are documented for GitLab, Bitbucket, and other CI/CD systems.

For vulnerability analysis, integrations include Google OSV and OWASP Dependency-Track. SBOM exchange is supported, but license analysis is not; teams needing both security and license review should choose another tool or add a separate license-analysis product.

Trust Centers can share SBOMs, VEX and CBOM artifacts, security certifications, penetration test reports, and compliance attestations. Custom domains and public or private access let vendors shape the sharing experience around their customers. Content is also consumable through the Transparency Exchange API (TEA), which supports programmatic access alongside the web experience.

The platform is open source and can be self-hosted or used as a hosted service. That gives teams a choice of deployment model, while the feature set centers on artifact generation, analysis, and sharing.

Pricing

Community: free. It includes one product, five components, unlimited SBOMs and compliance documents, public documents only, and one user. It is a useful way for an individual or small team to start, but the product and component caps and public-only sharing limit its use for broader customer programs.

Business: $159 a month (billed annually). It raises the allowance to five products and 200 components, retains unlimited SBOMs and compliance documents, and adds private documents and priority email support. The 14-day free trial lets teams assess the paid workflow before committing; annual billing and the five-product cap are important considerations for buyers.

Enterprise: custom pricing. It includes unlimited products and components, SSO/SCIM, a dedicated account manager, and SLA-backed support. Enterprise also lists role-based access controls, audits, and organization-wide roles, making it the tier for organizations with broader access-control and support needs. Teams should compare its custom quote with the Business tier’s fixed capacity and terms.

Platforms

sbomify supports API, Linux, macOS, self-hosted, web, and Windows environments. The combination of hosted and self-hosted deployment suits teams that need flexibility in where they run the platform.

Who it's for

Software vendors that need to produce SBOMs and present compliance evidence to customers are the clearest fit, particularly when private Trust Center sharing or CI/CD workflows matter. Software buyers verifying the security of software assets are also within the platform’s intended audience. Teams that need license analysis, or need more than one product and private documents without paying, should look elsewhere.

Pros and cons

• Pros: CycloneDX and SPDX support plus generation across 17 ecosystems, containers, directory scans, and Yocto/OpenEmbedded builds covers varied inputs.
• Pros: Trust Centers combine multiple security and compliance artifact types, custom domains, access controls, and API consumption.
• Pros: Open-source self-hosting is an option alongside the hosted service.
• Cons: Community is limited to one product, five components, one user, and public documents, restricting team and customer-facing use.
• Cons: Private documents require Business at $159 a month billed annually, and that plan remains capped at five products and 200 components.
• Cons: License analysis is not supported, leaving a gap for teams that need license-focused review.

Alternatives

SBOM Management Software is the category directory for comparing tools in this space.

• Sonatype Nexus Repository is worth considering if its free Community Edition’s full ecosystem support, CI/CD integration, and external PostgreSQL option better suit your setup.
• Interlynk may fit teams prioritizing a forever-free Community Tier with no per-seat fees or per-SBOM metering.
• CAST SBOM Manager offers a free download and is an option to compare for Linux or Windows use.
• Exodos Labs is an alternative with a free Community plan for one user, one API key, unlimited inventories, and community support.
• FOSSA may suit teams whose free plan’s five-project allowance, ten contributing developers, one release group, and five dependency levels for scans align with their needs.
• Ortelius offers a free OS plan with up to five components, unlimited users, unlimited endpoint tracking, and community support.
• OTNOS SBOM 360 is another free-plan option to compare.
• ReARM may appeal to teams seeking a free, self-hosted Community Edition for a single organization with core SBOM/XBOM storage and retrieval.

Verdict

Choose sbomify if your priority is to generate SBOMs across varied inputs and share security and compliance evidence through a customer-facing hub, with hosted and self-hosted options. Look elsewhere if license analysis is essential, or if the Community plan’s public-only sharing and strict product and component caps do not fit; private sharing starts with an annually billed Business plan.