SBOM Scope & Lifecycle

An SBOM (Software Bill of Materials) is generated at the scope you care about (commonly per branch).

What “Branch-Level SBOM” Means

1. Each branch can produce a different SBOM (different dependencies, versions, build files)
2. SBOM ties directly to:
   • SCA vulnerability findings
   • License findings
   • Reachability context (where supported)

SBOM Lifecycle:

1. Scan runs on PR/branch
2. Dependencies are discovered and normalized
3. SBOM is generated and stored in your S3-compatible bucket
4. SBOM can be exported and used for audits, compliance, and supply-chain reporting