CycloneDX / specification
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. SBOM, SaaSBOM, HBOM, AI/ML-BOM, CBOM, OBOM, MBOM, VDR, and VEX
Why this job: works in the areas we cover, but does not say which job it does
What it does
OWASP CycloneDX is a full-stack Bill of Materials (BOM) standard that provides advanced supply chain capabilities for cyber risk reduction. CycloneDX is an Ecma International standard published as ECMA-424. The OWASP Foundation and Ecma International Technical Committee for Software & System Transparency (TC54) drive the continued advancement of the specification.
Get started
No single install command. Read the steps in the README (opens in new tab)
- Maintenance
- Active
- Last commit 14 days ago
- Stars
- 578
- +4 this week
- Licence
- Apache-2.0
- Allows business use
- Downloads for
- None listed
- No release files
- Latest version
- 1.7.2
- Released 56 days ago
- Built with
- XSLT
- 70% of the code
Is it looked after?
- Contributors
- 8
- Last 90 days
- Issues
- 63% closed
- 187 still open
- Pull requests
- 462 merged
- 47 waiting
- Releases
- 13
- 4 in the last year
More: languages, topics, project record and preview image
Languages
- XSLT 70%
- HTML 7%
- Java 6%
- Go Template 5%
Topics
- bill-of-materials
- bom
- software
- spdx
- cpe
- license
- software-bill-of-materials
- sbom
- cyclonedx
- swid
- owasp
- supply-chain
Project record
- JobOther AI tools
- StatusListed
- Commits1,679
- Forks96
- Watching27
- Stars in 28 days+13
- CreatedMay 29, 2017
- First seen by usNov 7, 2026
- CheckedNov 12, 2026