Finding things
SBOMs and licenses
CycloneDX and SPDX, per repository and per branch, with a dependency graph in every document, kept after the scan that made them, and a license policy that can fail a build.
Both formats
Written for every repository and optionally for every branch, so a question about what shipped in a particular release has an answer. Registry enrichment fills in the licenses a manifest leaves blank by asking the registry the package came from.
A graph, not just a list
The tools these files exist for read the dependency graph rather than the component list, so a CycloneDX file without one loads into Dependency-Track as a project holding nothing, which looks exactly like a repository with no dependencies. Two hundred packages in the file and none of them anywhere the reader looks. Every reference in a document now has an entry of its own: whatever graph the scanner found is kept as it was, a component nothing points at hangs off the document root, and everything else gets an entry with an empty dependsOn. An empty array with the reference present says nothing was recorded, which is not the same statement as leaving the reference out.
They survive the scan
A scan used to write an SBOM for every repository into its own working directory and then delete that directory, so the one artifact procurement asks for by name never outlived the run that made it. They are copied out now, before that directory goes, including when the run was stopped part way: the repositories that did finish wrote theirs before the stop, and those are the ones somebody is waiting on. The Report files page offers both combined documents, the component and license rollup, and the per repository set as one zip.
Policy, not just a list
Licenses can be denied or flagged, and a denied license can fail the scan with a non zero exit code. The default deny list is the strong copyleft and source available licenses most organizations already care about, and it is a setting rather than an opinion baked in.
A license kept where another SBOM was silent
The same package under the same license in two repositories should not be licensed in one and unknown in the other, so a stated license is carried across and the copy that was filled in says where it came from. A license SPDX has an identifier for goes in as the identifier, a choice of two stays a choice rather than becoming both, and the document says how many packages nobody could license instead of leaving that to be counted.
What it does not do
License detection is as good as the metadata. A package that declares nothing and ships a LICENSE file nobody parses will come back unknown, and a registry answers in its own words, so an enriched license is often free text rather than an SPDX identifier: a deny list written only in identifiers walks past the spelled out forms. The SBOM files are the only ones on the Report files page that cannot be rebuilt from the database, because the database keeps the packages a finding was raised against rather than every component of every repository.
Every feature page carries one of those. The comparison page scores the same ground against five products people pay for, including the rows that go against us.