How to Check the Open Source in Your
Own Output in the AI Era
Background
The Answer We Usually Get vs. What Scanning Actually Finds
The answer isn't wrong — it's that what we each mean by "external software" differs. It's hard to write Python without pulling in public libraries.
You declared 9 — what actually shipped was 39
Those 9 pull in more libraries of their own. No one can track this list by hand.
Open Source Isn't Free — It's Conditional Permission
It looks free because you don't pay for it, but what it really means is permission granted on condition. Break the condition and it becomes a copyright problem.
A License Is the Copyright Holder's Terms of Use
Breaking License Terms Is Copyright InfringementCase
Complying with license terms isn't optional. Break them and it becomes unauthorized use — copyright infringement.
Known Vulnerabilities Are Public, Disclosed Flaws
The problem is: if you don't know which library you use and at what version, you can't cross-check it at all.
A Flaw Like This Almost ShippedCase
This was a package received normally through an official distribution channel. Without a record of the version and provenance, you wouldn't even know you were running that version after the problem became public.
An SBOM (Software Bill of Materials) Is a Parts List for Software
It records every component's name, version, license, and origin in a machine-readable format. It's not a document for people to read — it's a list a tool cross-checks automatically.
Name, version, license, and origin all go in a fixed format. There are two international standard formats: CycloneDX and SPDX.
Regulation and Submission Requirements Have Already Started
SBOMs required for software delivered to the federal government G7
50 minimum elements for AI SBOMs Europe
CRA vulnerability-reporting duty takes effect Customers and member companies
The submission requests already landing
Checking is a 3-step process
what's inside
obligations and vulnerabilities
review, and records it
The tool does the first two. A person does the third.
What BomLens Can Check
SBOM Generation and Open Source Risk Assessment, Locally, in One PassToday's tool
From source code, containers, firmware, a received SBOM, or an AI model, it produces an SBOM, an open source notice file, and security/license risk reports.
What Can It Scan
There Are 4 Ways to Run It — We'll Use the Script GUI Today
The Windows Installer Is One Double-ClickRun mode 1 / 4
(Rancher Desktop recommended)
BomLens-Setup.exe
"More info → Run anyway"
The macOS Installer Needs One More Terminal CommandRun mode 2 / 4
BomLens-Setup.dmg
to Applications
attribute in Terminal
If it still won't open on Apple Silicon, run codesign --force --deep -s - /Applications/BomLens.app once more. Once it opens, the same web UI appears in the app's own window, not a browser.
The Script GUI Opens With One Command in a FolderRun mode 3 / 4 · Today's demo
To scan a different folder, close that window and run it again from the folder you want.
The Script Just Produces Files, With No ScreenRun mode 4 / 4
--target examples/nodejs --all --generate-only
Before You Scan
The First Thing You Need Is a Manifest File
It's the file where your build tool declares which libraries the project uses. The scanner treats this file as its starting point, and the name differs by language — check where yours lives before you scan.
Today's example (Python) uses requirements.txt. If you use another language, find your row above.
Delete the manifest file and 39 becomes 0Key point
The code hasn't changed at all. The scanner doesn't infer libraries by analyzing your code — it resolves dependencies starting from the manifest. Zero results doesn't mean safe. It means the scan never ran.
That Signal Shows Up in the Run Log
Check the run log for these two lines. They're logged at different points, under different conditions.
Check These 4 Things Before You Scan
Checking just these four things heads off most zero-result false alarms.
Let's Generate One
A Flask-Based Example API Managed With requirements.txtToday's scan target
The 39 components and 19 vulnerabilities you've seen on earlier slides are the result of scanning this exact code.
Running ItDemo
One scan produces 4 artifacts
Result of a single scan
Reading the Results
The first thing to check when you open the results: 3 numbers
These three numbers alone tell you whether the scan actually worked.
The Results Screen Answers 3 Questions
Name, version, license, and origin all show on one row of the components screen. We'll come back to why the version matters shortly.
Working Through One ItemReal data from today's scan
When you see an item like this in your own project, work it the same way — check the license, cross-check the version, record the conclusion.
Every License Category Carries a Different ObligationKey point
Vulnerabilities Come With the Fixed Version Attached
CVSS, CVE, and fixed versions come from the ecosystem security databases Trivy cross-checks; EPSS is a live lookup against FIRST.org. On an air-gapped network only EPSS is skipped — everything else still shows.
AI Models and Datasets
Using a public model means checking 3 things
These three can each be different. It's easy to check the code license and call it done.
Real Cases for Code, Model, and Data — Each OneCase
| Layer | Case | Outcome |
|---|---|---|
| Code | The BusyBox GPL lawsuits (2009) | 14 companies sued, including Samsung and Best Buy; Westinghouse was ordered to pay over $100,000 in damages and stop distribution |
| Model | Getty Images v. Stability AI (2025) | The copyright claim against the model itself was dismissed, but a watermark left in outputs was found to infringe trademark |
| Training data | Bartz v. Anthropic (2025) | Training on pirated books came to light, leading to a $1.5 billion settlement — the largest copyright settlement on record |
Once it becomes litigation, this is the scale of damages you're looking at.
Scanning a Real Cell-Imaging Analysis ToolDemo
| Layer | Target | Finding |
|---|---|---|
| Code | github.com/MouseLand/cellpose | 113 components · 4 weak-copyleft |
| Model | huggingface.co/mouseland/cellpose-sam | BSD-3-Clause |
| Training data | cellpose.org/dataset | Out of the tool's reach |
The code and model are checked. But the training data is outside what the tool can reach — is it still safe to use as-is?
Even When You Go Looking, the Model Card Has No Training-Data Terms
The model card alone can't tell you — someone has to go find the original page.
Go Look, and Here's What You FindCase
So the verdict is non-commercial, no-redistribution terms — something only a person reading the original text could have found, not the tool.
Intended Use Changes the License Verdict
The non-commercial terms on cellpose.org we just found carry different weight depending on how you intend to use it.
Where Automated Checking Stops
4 things the tool leaves unanswered, on purpose
When there's no basis to decide, the tool doesn't guess — it leaves the state as-is.
3 Things That Leave Evidence Behind the Results
same SBOM
through validation
human judgment
Keep the Record in a Single Table
For anything the tool only flagged as "needs review," record the project owner's decision and the reasoning like this.
| Item | Disposition | Rationale | Date · Owner |
|---|---|---|---|
| Modelica | License confirmed | GitHub repository license detection confirmed BSD-3-Clause | 09-06 · J. Doe |
| Buildings | Needs review | No standard LICENSE file on GitHub — must check the repository docs directly | 09-06 · J. Doe |
| analysis_core.py | In-house code | Written internally, no external code referenced | 09-06 · J. Doe |
Keep it in the same folder as the SBOM output. Whoever inherits the project should be able to answer why it was handled that way.
When Should You Rescan?
There are two triggers for rescanning — something changed, or time has passed.
bumping a version
Run it once and stop, and all you have is a snapshot of that one moment. If the submitted list and what actually shipped diverge, the notice itself becomes wrong.
Do These 3 Things After You Scan
Whatever's left on the results screen doesn't resolve itself. Work through it in this order.
for vulnerabilities
licenses and record it
with the SBOM
Wrap-Up
Here's How to Get Started
No complicated onboarding — just follow these steps.
installing
own project
Managing Many Projects Over Time Needs an SCA Platform
SCA (Software Composition Analysis) is the automated discovery of open source components, licenses, and vulnerabilities. BomLens is one such tool.
TRUSCAThank You
That covers everything for today.
Send your scan log along with your question and we'll take a look.
The tool only goes as far as finding what needs review — deciding whether something is safe to use still needs its own review.