Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Jul 14, 2026

Scanners

Check SBOM components against known advisories

Scan software bills of materials for known-vulnerable dependencies.

Agent
Audit dependencies for known CVEsScan many SBOMs in one runGate a build pipeline on severity

overview

What bomber does

Place bomber after an SBOM generator such as syft or trivy. It answers the supply-chain question: which declared components already carry known advisories.

Reach for it when the bill of materials exists and you need OSV or OSS Index matches before release. It does not invent the SBOM, and it does not probe a running app.

Feed sbom-file or sbom-folder, choose --provider (osv default, or ossindex with --username and --token), and set --output to json, xml, or stdout. Results land as a file and folder for triage.

source github.com/devops-kung-fu/bomber

use cases

Where bomber fits

Audit dependencies for known CVEs

Scan a project's SBOM so every shipped component is checked against an advisory database, catching vulnerable libraries before they reach production.

Scan many SBOMs in one run

Point bomber at a folder of SBOMs to check a fleet of services or images at once and produce a single set of supply-chain findings.

Gate a build pipeline on severity

Emit JSON and route the findings into a workflow step that fails when a high-severity component appears, keeping known-vulnerable dependencies out of a release.

Choose a vulnerability provider

Run against OSV with no credentials for a quick pass, or supply OSS Index credentials with --username and --token when you want that provider's coverage and detail.

reference

bomber inputs and flags

7 inputs
NameTypeFlagDescription
sbom-fileFILE·A single SBOM file to scan.
sbom-folderFOLDER·A folder of SBOMs to scan in one run.
providerSTRING--providerVulnerability provider: ossindex or osv (default osv).
outputSTRING--outputOutput format: json, xml, or stdout (default stdout).
tokenSTRING--tokenAPI token for the chosen provider.
usernameSTRING--usernameUsername for the chosen provider.

Showing key inputs. bomber exposes 7 inputs in total.

Full flag reference (7 inputs)
NameTypeFlagDescription
sbom-fileFILE·Single SBOM file.
sbom-folderFOLDER·Scan a folder of SBOMs.
providerSTRING--providerThe vulnerability provider (ossindex, osv) (default "osv").
outputSTRING--outputHow bomber should output findings (json, xml, stdout) (default "stdout").
tokenSTRING--tokenThe API token for the provider being used.
usernameSTRING--usernameThe user name for the provider being used.
debugBOOLEAN--debugDisplays debug level log messages.

example

Run bomber

bomber · command
# scan a CycloneDX SBOM against OSV and emit JSON findingsbomber scan --provider osv --output json app.cyclonedx.json
sample output
Loaded provider: osv Files:            1Packages:         214Vulnerabilities:  3 SEVERITY   PACKAGE                          VULNERABILITYCRITICAL   pkg:npm/lodash@4.17.15           CVE-2021-23337HIGH       pkg:pypi/pyyaml@5.3.1            CVE-2020-14343MODERATE   pkg:npm/minimist@1.2.5           CVE-2021-44906

guidance

Choosing bomber

Use bomber when you already have an SBOM and need known-vulnerable components listed. Generate the SBOM first. For scanning container images or filesystems directly, use trivy instead.

trivy

Scans images, filesystems, and SBOMs broadly. bomber stays focused on SBOM-to-advisory checks.

bandit

Static analysis of Python source. bomber checks declared dependencies rather than your code.

semgrep

Pattern-based static analysis of source. bomber answers the dependency advisory question instead.

faq

bomber questions

A software bill of materials as a single file or a folder. It reads declared components and checks each against a vulnerability provider. Produce the SBOM first with syft or trivy.

related

More Scanners tools

  1. ac-scanner

    BHUSA Arsenal TLS/SSH crypto inventory with post-quantum readiness signals and CBOM-shaped output.

  2. airixss

    Reflection triage for parameter URLs during recon.

  3. bedrock-keys-security

    Black Hat Arsenal hunting for phantom IAM users behind Bedrock keys, with offline key decode and org scan.

  4. cmseek

    CMS detection and version fingerprinting.

  5. jaeles

    Signature-driven web application scanner.

  6. joomscan

    OWASP Joomla vulnerability scanner for CMS flaws and misconfigurations.

Run bomber yourself

An SBOM feeds bomber, which checks each component against a vulnerability provider and writes the vulnerable dependencies as a queryable output.

Open bomber in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.