Developer Tools · CERT-In SBOM completion

SBOMReady

SBOMs buyers accept.

Check your SBOM against the 21 data fields CERT-In lists, and fill the gaps from lockfiles, OSV and package registries.

Vendors selling to government and PSUsBanks and regulated buyersIT services and export firms

sbom-ready · example

$ sbom-ready check sbom.cdx.json --osv --registry
435 components · Next.js app lockfile
Before: 53% of required data · 12/21 fields complete
After OSV + registries: 72% · 14/21 fields complete
1 component with a known vulnerability

Real run on one of our own applications.

StandardCERT-In SBOM fields

Fills fromLockfiles, OSV, registries

Runs onYour laptop, server or CI

FormatsCycloneDX, SPDX

The problem

Government and bank buyers now ask for SBOMs in CERT-In's format. Generators like Syft cover only part of the 21 fields, and several have no standard slot.

What it does

Checks CycloneDX and SPDX against all 21 CERT-In data fields

Generates an SBOM from package-lock.json, requirements.txt and go.mod

Fills vulnerabilities and patch status from OSV, and description, supplier and release date from npm and PyPI

Gaps sheet for criticality, EOL and usage restrictions that merges back into the SBOM

Coverage score for a CI gate

VEX document (CycloneDX) listing each known vulnerability and the components it affects, ready to triage

How it works

Generate or upload your SBOM
See coverage per field and fill gaps automatically
Fill the rest in the sheet and export a complete SBOM

Works with

CycloneDXSPDXSyftOSVnpmPyPIMaven

Runs in your CI

GitHub Actions workflow step

- run: sbom-ready generate . -o sbom.cdx.json
- run: sbom-ready check sbom.cdx.json --min-score 90

Licensed customers get the action or command-line tool installed in their own organisation; it runs on your runners, so your code and plans never leave them. The command-line tools run in GitLab CI the same way.

Your data

Runs on your SBOM and lockfiles.
Only package names are looked up publicly.
Your source stays local.

Who it's for

Vendors selling to government and PSUsBanks and regulated buyersIT services and export firms

Questions

Doesn't Syft already do this?

Generators cover part of CERT-In's list; this checks all 21 fields and fills what's missing.

Who asks for it?

Government and bank buyers, increasingly in tenders.

Often used with SBOMReady

Developer Tools

RunbookFinder

Engineering knowledge search

Answers your engineers can trust. Ask how a system works and get the runbook section, the postmortem and the code, with who owns it and whether it's out of date.

₹20,000–50,000View product → Developer Tools

TestHealer

Self-healing test fixes

Redesign without breaking tests. After a redesign, find every UI test selector that broke, the element it meant, and a verified fix as a diff. The same for API version bumps.

₹25,000–75,000 per suiteView product → Developer Tools

A11yReady

Accessibility audit

Accessible by design, compliant by law. Audit your website against WCAG 2.2 AA and see what each issue means under the European Accessibility Act, the ADA, and UK, Australian and Indian rules.

₹35,000–75,000View product →

← PreviousIndiaStackMock Next →GIGWCheck

See SBOMReady on your own data

A 30-minute call. We run the product on your export, repository or document and walk you through the results.

Book a demo