Questions

Short answers, with links to the pages that go into detail.

Is my SBOM stored?: No. The file is parsed in memory and discarded. We keep the report built from it: for 24 hours without an account, or until you delete the project if you have one. What happens to your file.
What leaves this service?: Package names and versions go to OSV.dev, and the CVE identifiers found go to FIRST for EPSS scores. The CISA catalogue is downloaded whole. Your file, its name and your identity aren’t sent. Subprocessors lists everyone who sees your data.
Why isn’t a high-severity finding in Fix now?: Fix now means a fix exists and the flaw is known to be exploited, or likely to be. Severity alone can’t lift a finding above Fix soon. The thresholds are on the method page.
Does a clean report mean my software is safe?: No. It means none of the components you declared matched a published advisory when it was checked. It can’t see code your SBOM left out, and it can’t tell whether vulnerable code is reachable.
Why is the grade missing?: We withhold the grade when part of the assessment is incomplete. For example, a data source didn’t answer, some components couldn’t be matched, or versions came from ranges rather than a lockfile. The report names what was missing. A finding published without a severity score doesn’t withhold the grade. It’s counted as high, so the grade errs on the strict side.
Does it make us compliant with the Cyber Resilience Act?: No, and nothing here claims to. It can help you keep a machine-readable SBOM and act on what it finds. The CRA page drafts wording for documentation you’re still responsible for.
Can I use it on a supplier’s SBOM?: Yes, if you’re entitled to analyse it. Supplier SBOMs starts by showing how much of the document can actually be checked.
What does it cost?: Nothing during early access, and no price has been set. If that changes, we’ll tell you well in advance. An account with no payment method can’t be charged.
Can I run it myself?: Not yet. The source isn’t published, so for now the hosted service is the only way to use it.
Who runs it?: One person, as a personal project. The imprint and contact pages show what’s been published about the operator so far.