sbom-sanitizer

This is a simple tool that sanitizes a CycloneDX SBOM by removing potentially sensitive information such as component names, filenames, paths, etc. It identifies the most common fields that may contain sensitive information and removes them.

Why?

SBOM (Software Bill of Material) files are an increasingly important way of being aware of your software stack as well as determining and proving the security status of your dependencies. SBOMs are often shared with third parties doing due diligence or security checks.

The problem is that SBOMs themselves can contain information you don't want to share about your internal systems, such as component names, file paths, etc. Most tools that process SBOMs only care about dependencies and versions.

Feedback

PRs and issues are welcome if it's not removing something you would like sanitized prior to sharing externally. We could add more options or sanitize data differently if it breaks compatibility with a tool.