LightworksBETA
← PRODUCT
SECURITY

Your dependency graph. On every commit.

Lightworks generates a Software Bill of Materials from your dependency manifests on every push — OSV.dev CVE scan included. The SBOM record lands in your QMS automatically, linked to the commit that triggered it. Section 5 of your DHF, always current.

github actions — sbom.yml
Checkout repo @ main
Parse package.json, requirements.txt
OSV.dev CVE scan → 0 critical
Pushing SBOM record to lightworks…
POST /api/v1/records
db: "sbom", commit: "a3f71c2"
bash
SBOM record created
{
"id": "sbom-k4np8w",
"commit": "a3f71c2",
"cve_critical": 0,
"dependencies": 142
}
01

Parsed from your manifests

package.json, requirements.txt, go.mod, Gemfile. Lightworks reads what's already there — no separate config, no manual exports.

02

CVE scan on every commit

OSV.dev integration flags critical vulnerabilities before they reach a release. The SBOM record carries the scan result alongside the dependency list.

03

Ships inside your DHF

The SBOM is section 5 of your Design History File. When you compile a release, the current SBOM is already there — no last-minute scramble.