SBOM dependency inspector
Inspect CycloneDX 1.5/1.6 or SPDX 2.3 JSON components and dependency edges. Check purl/CPE syntax, duplicate and missing references.
- Runs in your browser
- No upload
- Check before download
Inspect CycloneDX 1.5/1.6 or SPDX 2.3 JSON components and dependency edges. Check purl/CPE syntax, duplicate and missing references. This is a versioned inventory/graph profile, not vulnerability scanning or full SBOM certification.
Method: CycloneDX 1.5/1.6 / SPDX 2.3
Local processing
Input stays in your browser worker, without requests, storage or content telemetry. Original backups and explicitly revealed exports may contain secrets; keep them local.
Resource limits
Combined input ≤1 MiB; text ≤200,000 characters (XML 100,000); depth 32 / nodes 20,000 per document; at most 1,000 rows/operations; output ≤2 MiB; worker deadline 5 s. Cancel terminates the worker. These application bounds do not guarantee a total browser heap cap.
Choose the profile and review diagnostics before using saved output. Editing, resetting or leaving cancels work and discards the preview. Save original backups separately; no source file is overwritten.
Original backup: 1048576 B / Inspect / generate
How to inspect this input
- Source
Inspect CycloneDX 1.5/1.6 or SPDX 2.3 JSON components and dependency edges. Check purl/CPE syntax, duplicate and missing references. This is a versioned inventory/graph profile, not vulnerability scanning or full SBOM certification.
- Declared profile
CycloneDX 1.5/1.6 / SPDX 2.3
- Review and save
Choose the profile and review diagnostics before using saved output. Editing, resetting or leaving cancels work and discards the preview. Save original backups separately; no source file is overwritten.
- Original backup
Input stays in your browser worker, without requests, storage or content telemetry. Original backups and explicitly revealed exports may contain secrets; keep them local.
Questions about the profile
Declared profile
Inspect CycloneDX 1.5/1.6 or SPDX 2.3 JSON components and dependency edges. Check purl/CPE syntax, duplicate and missing references. This is a versioned inventory/graph profile, not vulnerability scanning or full SBOM certification. CycloneDX 1.5/1.6 / SPDX 2.3
Local processing
Input stays in your browser worker, without requests, storage or content telemetry. Original backups and explicitly revealed exports may contain secrets; keep them local.
Resource limits
Combined input ≤1 MiB; text ≤200,000 characters (XML 100,000); depth 32 / nodes 20,000 per document; at most 1,000 rows/operations; output ≤2 MiB; worker deadline 5 s. Cancel terminates the worker. These application bounds do not guarantee a total browser heap cap.