Dependquarry: SBOM Review

来自 App Store 来源

Dependquarry is a private software-bill-of-materials review bench for developers, maintainers, auditors, consultants, and small security teams who need a human-readable decision layer without uploading product composition. Turn machine-oriented SBOM records into an offline, accountable component review with explicit evidence gaps. KEY FEATURES - CycloneDX and SPDX JSON import - Component and evidence register - Severity and dependency-depth screen - Package URL and provenance notes - Reachability and disposition workflow - License evidence tracking - Portable component decision artifact - No source-code or SBOM upload - Native structured-file or CSV import - Local PDF, workspace JSON, and domain-artifact export - No account, ads, analytics, tracking, IAP, or subscription Dependquarry interprets imported component metadata and user-entered findings; it does not fetch advisories, prove exploitability, determine legal obligations, or certify a product. Verify package identity, versions, reachability, licenses, provenance, and current advisories with accountable experts.

答案里的每个数字都来自本页上方展示的数据，可以逐条核对。