Procurement asked for a file. Now you can send them one.
29 August 2026 · 3 min read · by Admin
A few weeks back I wrote about the email every small vendor eventually gets: your biggest customer's security team wants an SBOM and your current vulnerability status. The advice held up, but it stopped one step short of the finish line.
You could see your dependency list in the Snapshot. You could read it on screen, share the link, print the report to PDF. What you couldn't do was hand over an actual SBOM file, which is what the person on the other end of that email was asking for.
As of this week you can. Every Snapshot now has a download button that gives you a CycloneDX JSON SBOM, and it's on the free tier along with everything else in the report.
Why a JSON file and not a PDF
A PDF of a dependency table is a picture of an answer. It's fine for a human to skim and useless for anything else.
The security team asking for your SBOM usually isn't planning to read it. They're going to load it into their own tooling: a vulnerability scanner, a supply-chain dashboard, whatever their procurement process runs on. That needs a machine-readable file in a standard format, which is what CycloneDX is. Sending one means your submission goes through their pipeline instead of landing in someone's inbox as homework.
It also changes how the exchange feels. "Here's our SBOM, attached" is a different conversation from "here's a link to a report, let me know if you need anything else."
What's actually in the file
The components your product is built from: names, versions, and package identifiers, in the CycloneDX component format.
One detail worth knowing. The file is generated from your lockfile, not your manifest. So the versions in it are the resolved ones you're actually shipping, not the loose ranges in your composer.json or package.json. That distinction matters when a customer cross-references your SBOM against a vulnerability feed, because a range tells them nothing about whether you're exposed and an exact version tells them everything. It's also the reason committing your lockfile keeps turning up as the cheapest thing you can do for yourself here.
Composer and npm are supported today, same as the rest of CRAIR. Nothing about the download reads your source code; it works from the dependency manifest, exactly as the scan always has.
The other reason to have one on hand
The procurement email is the reason this feature exists, but it isn't the only deadline attached to it. From 11 December 2027, the full Cyber Resilience Act expects an SBOM as part of the technical documentation for products placed on the EU market. That's a while away, and it's not something to panic about this week. It does mean the file you generate to answer a customer today is the same artefact you'll need to have on file later.
Two birds, one download.
Try it
If you've already run a Snapshot, the download is there now. If you haven't, it's a repo URL or a lockfile and about a minute.