Security & Supply Chain

Niksphere publishes a Software Bill of Materials (SBOM) alongside the release artifacts of its products, so that customers, auditors, and automated vulnerability scanners can verify exactly what a given build contains.

Software Bill of Materials (SBOM)

For every release build, an SBOM is generated in CycloneDX JSON format (currently spec version 1.6), listing every dependency that is actually compiled into or packaged with the released artifact — with its exact version, a cryptographic hash, and its license, where detectable.

Coverage

Product	SBOM scope
CLI	One SBOM per platform binary, covering the Go module graph
Engine	One SBOM per platform binary, covering both the Go module graph and the npm dependencies of the embedded web frontends
VS Code Extension	One SBOM for the packaged extension (.vsix), covering its npm dependencies

Cloud not yet covered

Niksphere Cloud does not yet publish an SBOM. This page will be updated once that coverage is added.

Where to find it

Each SBOM is published as a release asset alongside the corresponding binary, .vsix, and manifest.json, named <product>-<version>[-<platform>]-sbom.cdx.json — for example niksphere-cli-v1.1.0-linux-x64-sbom.cdx.json. See the Release Notes and each product's reference section for links to its releases.