BOM types
The seven Bill of Materials types TraceGuard tracks.
A Bill of Materials isn't only about software. TraceGuard records uploads under a BOM type so different inventories stay distinct while flowing through the same pipeline.
| Type | Key | Covers |
|---|---|---|
| Software | sbom | Application packages and libraries. |
| Hardware | hbom | Physical components and boards. |
| Cryptography | cbom | Cryptographic algorithms, protocols, and dependencies. |
| SaaS | saas_bom | Services and the calls between them. |
| AI | ai_bom | AI system components. |
| ML | ml_bom | Machine-learning models and artifacts. |
| Operations | obom | Operational/runtime components. |
You set the type when uploading (the bom-type input on the Action, or the
bom_type form field on the API). Most teams start with sbom; the others matter
for hardware, crypto-agility (CRA), and AI/ML supply-chain work.
HBOM and SBOM together
Most devices have both: an HBOM for the parts and an SBOM for the software they run. Upload both to the same project and TraceGuard reads them together.
A hardware part often reaches a vulnerability through software. An iPad's cellular
chip is patched by an iOS update, for example. If the HBOM maps that chip to the same
CPE product as a software component in the SBOM (say both use apple:iphone_os), the
chip's findings are judged at the software version the SBOM declares:
- a vulnerability the declared version is not affected by (for example because an update fixed it) is marked out of scope, naming the SBOM component. TraceGuard checks the declared version against the same vulnerability data in the same scan; it never infers this from fix-version lists alone;
- a vulnerability that still affects that version is shown on the SBOM's software component and counted once, there.
Anything TraceGuard cannot prove this way stays active on the HBOM — for example when the SBOM's own scan doesn't show it yet, or when the SBOM's CPE can't be matched at all. Out-of-scope findings stay visible with their reason; they just aren't counted. Uploading a new SBOM (for example after an iOS update) re-evaluates the project's HBOM automatically.
Findings are fixed when a BOM is scanned. An HBOM last scanned before this check was introduced (October 2026) keeps its old findings until it is scanned again: open the HBOM and click Scan.