Dependencies and SBOM (SCA)

Cerberon inventories dependencies, matches each one against OSV advisories, and ranks the results with CISA KEV, EPSS and end-of-life data. Every dependency scan produces an SBOM.

Start a dependency scan from New Scan > Dependencies (SCA).

Supported inputs

Ecosystem	Lockfiles and manifests
JavaScript, TypeScript	package-lock.json, npm-shrinkwrap.json, pnpm-lock.yaml, yarn.lock, bun.lock
Python	poetry.lock, uv.lock, Pipfile.lock, requirements.txt
Go	go.mod, go.sum
Java and JVM	pom.xml, build.gradle, build.gradle.kts, gradle.lockfile, gradle/dependency-locks/*.lockfile, libs.versions.toml
.NET	packages.lock.json, packages.config, Directory.Packages.props, *.csproj
Rust	Cargo.lock
PHP	composer.lock
Ruby	Gemfile.lock

Cerberon also reads container images, and CycloneDX (JSON or XML) or SPDX (JSON or tag-value) documents. The binary bun.lockb is not read. Use the text bun.lock.

What each finding includes

• Advisory match by ecosystem, package name and version.
• CISA KEV status. If the catalogue cannot be read, the status shows as unknown.
• EPSS score and percentile, when published. A missing score is not a low score.
• Fixed version, when the advisory names one.

Exploitability (VEX)

Each advisory carries a VEX status that Cerberon can justify from its own data. It never asserts a status it cannot prove.

Status	When it is used
Affected	The installed version is inside the advisory’s affected range.
Under investigation	The advisory database matched the version, but the affected range does not explain the match.
Fixed	A rescan of the same asset finds the component at or above the published fix.
Not affected	A rescan of the same asset no longer matches the advisory, without reaching a published fix.

Export the statuses as an OpenVEX document. See Export an SBOM.

Container images

Cerberon inventories the image’s packages and layers, then matches them like any other dependency list. For a private registry, save a registry credential on the Scan Details step: registry host (Docker Hub if empty), username, and password or token. The credential is sealed for the project and never stored in the scan target or job record.

Export an SBOM

Export from a completed scan in the console, or through the API:

curl -sSf -H "Authorization: Bearer $CERBERON_TOKEN" \
  "$CERBERON_URL/api/jobs/$JOB_ID/sbom/export?format=cyclonedx-json" \
  -o sbom.cdx.json

Format	format value	Standard
CycloneDX JSON	cyclonedx-json	CycloneDX 1.5
CycloneDX XML	cyclonedx-xml	CycloneDX 1.5
SPDX JSON	spdx-json	SPDX 2.3
OpenVEX	openvex-json	OpenVEX. Requires variant=private.
CSV	csv	Spreadsheet inventory

Exports are public by default and leave out vulnerability detail. Add variant=private to include it. SPDX and CSV cannot carry vulnerability data, so a private export in those formats is refused.

SBOM documents are signed with Ed25519. The public key is at /.well-known/cerberon-signing-key on your instance.

Cryptographic BOM (CBOM)

A CBOM is a CycloneDX 1.6 inventory of the cryptography a completed scan observed. It is built from a TLS handshake the scan made, cryptographic weaknesses found in source code, or a keystore you consented to analyse. It is not a separate scan type. View it under SBOM / CBOM > CBOM.

The CBOM records TLS protocols and cipher suites, X.509 certificates and key material, and each algorithm’s NIST quantum security level where it can be derived. CERT-In v2.0 fields are filled where the observation supplies them. Fields that cannot be observed are marked unobtainable with the reason.

A CBOM exports as CycloneDX JSON, CycloneDX XML or CSV.