BOMHort Joins OpenSSF as Sandbox Project to Tackle SBOM Management at Scale

Compliance mandates including the EU Cyber Resilience Act, NIST SSDF, and Executive Order 14028 have transformed software bill-of-materials generation from an optional practice into a regulatory necessity. Yet creating SBOMs represents only part of the work. For security and platform teams, the real operational burden lies in managing, querying, and analyzing thousands of SPDX and CycloneDX documents spread across microservice environments.

BOMHort, previously called SeeBOM, has now become an official Sandbox Project within the Open Source Security Foundation. The platform operates as a Kubernetes-native system designed to consume, standardize, and present SBOMs at enterprise scale, delivering unified visibility across the software supply chain to security, compliance, and engineering teams.

Core Technical Features

BOMHort addresses high-volume SBOM operations and delivers real-time vulnerability tracking through several integrated capabilities:

• High-Throughput Ingestion & Processing: Distributed parsing workers handle incoming SPDX, CycloneDX, and in-toto attestation envelopes with SHA256 deduplication and queue-based scaling, including direct S3-native ingestion.
• Continuous Vulnerability Intelligence: Rather than triggering complete SBOM rescans, the system performs batch lookups via OSV alongside daily CVE updates to identify newly disclosed vulnerabilities affecting existing projects. It natively processes VEX (Vulnerability Exploitability eXchange) statements to accurately classify suppressed or active risks.
• License Governance: Includes built-in support for the CNCF Allowed Third-Party License Policy. Externalized policy and exception configuration files enable teams to categorize permissive, copyleft, and unidentified licenses without code modifications.
• High-Performance Analytics: Leverages ClickHouse MergeTree tables and materialized views to deliver sub-second queries across Package URLs (PURLs), CVEs, license risks, and version skew spanning thousands of SBOMs.
• Modern Developer Interface: Provides a stateless REST API with 19 endpoints and an Angular 19 dashboard offering global search, virtual scrolling, and customizable CSS-variable dark and light themes.
• Flexible Kubernetes Deployment: Supports local deployment via Docker Compose or Kind, as well as production Kubernetes environments using Helm charts for the API, background workers, web UI, and CronJobs.

Compliance and Audit Readiness

Organizations facing EU CRA compliance obligations or needing to demonstrate continuous supply chain integrity to auditors can leverage BOMHort as a centralized reference system. The combination of ongoing OSV vulnerability monitoring, VEX-aware suppression capabilities, and automated license policy enforcement enables platform teams to produce auditable, transparent compliance documentation across all software projects within minutes.

OpenSSF Governance

Moving BOMHort into the OpenSSF Sandbox framework guarantees the tool remains fully open, community-governed, and independent of any single vendor. Operating under neutral governance creates opportunities for deeper collaboration with other OpenSSF projects, standards organizations, and maintainers focused on supply chain security.

Community Participation

BOMHort operates entirely in the open under the Apache-2.0 license. The project welcomes all forms of participation, including feature suggestions, bug reports, code submissions, and documentation enhancements.

• GitHub Repository: github.com/seebom-labs/BOMHort
• Documentation & Architecture: docs.bomhort.dev
• Project Website: bomhort.dev
• Slack Channel: #bomhort