By Mario Fahlandt
As regulatory requirements like the EU Cyber Resilience Act (CRA), NIST SSDF, and Executive Order 14028 take effect, generating a Software Bill of Materials (SBOM) has shifted from a best practice to a strict requirement. However, for platform and security teams, generating SBOMs is only half the battle. Managing, querying, and analyzing thousands of SPDX and CycloneDX documents across microservice architectures creates massive operational overhead.
To solve this challenge, we are thrilled to announce that BOMHort (formerly known as SeeBOM) has officially joined the Open Source Security Foundation (OpenSSF) as a Sandbox Project!
BOMHort is a Kubernetes-native platform built to ingest, normalize, and visualize SBOMs at scale, giving security, compliance, and engineering teams centralized visibility into their software supply chain.
Key Technical Capabilities
BOMHort is designed for high-throughput SBOM workflows and real-time vulnerability intelligence:
- High-Throughput Ingestion & Processing: Scalable parsing workers process incoming SPDX, CycloneDX, and in-toto attestation envelopes using SHA256 deduplication and queue-based scaling, supporting direct S3-native ingestion.
- Continuous Vulnerability Intelligence: Instead of requiring full SBOM re-scans, BOMHort uses batch lookups via OSV alongside a daily CVE refresher to map newly disclosed vulnerabilities back to affected projects. It natively handles VEX (Vulnerability Exploitability eXchange) statements to mark suppressed or effective risks accurately.
- License Governance: Ships out-of-the-box with the CNCF Allowed Third-Party License Policy. Externalized policy and exception configuration files allow teams to classify permissive, copyleft, and unknown licenses without needing code rebuilds.
- High-Performance Analytics: Built on ClickHouse MergeTree tables and materialized views, enabling sub-second cross-project queries across Package URLs (PURLs), CVEs, license risks, and version skew over thousands of SBOMs.
- Modern Developer Interface: Powered by a stateless REST API (19 endpoints) and an Angular 19 dashboard featuring global search, virtual scrolling, and configurable CSS-variable dark/light themes.
- Flexible Kubernetes Deployment: Easily deployable locally via Docker Compose or Kind, or directly into production Kubernetes using Helm charts for the API, background workers, web UI, and CronJobs.
Built for Cyber Resilience & Audit Readiness
Whether your organization needs to satisfy EU CRA requirements or prove continuous supply chain integrity to auditors, BOMHort acts as a centralized source of truth. By combining continuous OSV vulnerability monitoring with VEX-aware suppression and automated license policy checks, platform teams can generate queryable, transparent compliance evidence across all software projects in minutes.
Why OpenSSF?
Transitioning BOMHort to an OpenSSF Sandbox project ensures that the tool remains completely open, community-driven, and vendor-neutral. Developing under neutral governance allows us to collaborate closely with other OpenSSF initiatives, standards bodies, and maintainers working on supply chain security.
Get Involved!
BOMHort is developed entirely in the open under the Apache-2.0 license, and we welcome contributions of all kinds, from feature requests and issue reports to code contributions and documentation improvements.
- GitHub Repository: github.com/seebom-labs/BOMHort
- Documentation & Architecture: docs.bomhort.dev
- Project Website: bomhort.dev
- Slack Channel: #bomhort
Welcome to the OpenSSF community!
About the Author
Mario Fahlandt is a cloud-native open source contributor focused on supply chain security and Kubernetes governance. He is Co-Chair of Kubernetes SIG Contributor Experience, leads the Kubernetes AI Conformance subproject, and serves on the CNCF Technical Oversight Committee. He is a core maintainer of BOMHort, an SBOM governance platform now joining the OpenSSF. By day, he works as a Customer Delivery Architect at Kubermatic.