example-monorepo

What this report couldn’t see

• sbomtriage analyses the inventory declared in your SBOM. It does not read your source code, so it cannot tell whether a vulnerable function is ever reached or executed.
• A "Fix now" rating reflects known exploitation or a high predicted exploitation probability. It is not evidence that you have been compromised.
• Results are only as complete as the SBOM. Components your SBOM generator missed (vendored code, statically linked libraries, bundled assets) are invisible here.
• Compensating controls, network position, and runtime configuration are not considered. A finding that is unreachable in your deployment will still be listed.
• Advisory data comes from OSV.dev. Vulnerabilities published very recently, or not covered by OSV for your ecosystem, will not appear.
• The input contains no dependency graph, so direct and transitive dependencies cannot be distinguished. Lockfiles rarely carry one.
• No VEX statements were found in this SBOM, so no findings have been ruled out by the vendor. Some listed vulnerabilities may not apply to how the component is used.
• Severity for advisories published only with a CVSS v4.0 vector is shown qualitatively; no v4 base score is computed rather than presenting an approximation as fact.

How the grade was reached

Every score starts at 100 and loses points against published thresholds. There are no judgement calls, so you can check and dispute every deduction.