An open-source, one-click SBOM tool for supply-chain security and regulatory compliance.
An open-source, one-click SBOM tool for supply-chain security and regulatory compliance.
SK Telecom now requires its suppliers to submit an SBOM.
Those suppliers — often with no security team — had no simple way to make one.
BomLens is that tool. Everything else follows from this one fact.
Not a governance portal · not SaaS · not a compliance verdict.
Where cdxgen's official image finds 0 Ruby and 5 Rust components, ours finds 9 and 180. Real builds, not manifest parsing — exact transitive versions, lockfile or not.
Notice, security report, risk report and conformance — all in one run.
A Java/Maven project folder, in the desktop app. No command line. SBOM, open-source notice and security report in a single run.
Open the desktop app · pick the project folder
Components. Vulnerabilities with EPSS and CISA KEV. Licenses classified by copyleft strength.
Overview → Components → Dependencies → Vulnerabilities → Licenses
EPSS — Exploit Prediction Scoring System · CISA KEV — the U.S. CISA Known Exploited Vulnerabilities catalog
A public repo pins 14 direct dependencies — no lockfile, no local checkout. A real install inside the container surfaces 39 components, transitive versions exact.
same app · paste a Git URL · 39 components
A regulation lands on a customer; the customer passes it to its suppliers as "send us an SBOM." So the next two demos check an SBOM against exactly these rules — it makes gaps visible, it does not certify compliance.
Two SBOMs a supplier might send. One in SPDX fails the minimum elements — no version, PURLs on 25%, no dependency graph. One in CycloneDX passes — yet carries 6 critical known-exploitable vulnerabilities. Completeness isn't safety.
Upload SPDX → the gaps · upload CycloneDX → the CVEs
Two HuggingFace models, from an AI team's seat. One is clean. The other — CC-BY-NC, pickle-format — BomLens flags caution before you build on it. Each becomes a CycloneDX ML-BOM checked against the G7 minimum elements and the EU AI Act.
EU AI Act obligations start 2 August 2026. A preparation aid — not a compliance certificate.
Local-first is deliberate — but one laptop can't govern a whole supply chain. BomLens emits standard CycloneDX, so the SBOM flows into any portal that reads it — here, TRUSCA by TrustedOSS.
Upload the demo-1 SBOM to TRUSCA · read it back
A regulation lands on a customer. The customer turns it into "send us an SBOM." That request reaches a supplier with no tooling — which is exactly where we started.
The difference now is the tool. Your source never leaves the laptop; the standard SBOM is the one thing built to travel onward.
It makes gaps visible — it does not certify compliance.
Download the desktop app, double-click, and scan — it checks Docker, pulls the image, and opens the UI. No console.
Prefer the command line? docker pull ghcr.io/sktelecom/bomlens:latest
ありがとうございます
Questions?