Blog
How bomwerk builds software inventories you can hand to an auditor, and the trade-offs behind them. No hype, concrete numbers, limitations stated.
-
The Nightmare Repo Has Real Numbers. Now You Can Check Them Yourself.
bomwerk/nightmare has carried a ground-truth benchmark against syft, cdxgen, and sbom-tool for weeks. Until now, bomwerk's own row couldn't be independently reproduced. The open-source core plus the v1.0.0-rc.1 tag change that. Here are the numbers, what they don't prove, and the exact commands to run them yourself.
-
bomwerk Is Open Source Now. Here's Exactly What That Means.
The scanner's core, parsers, heuristics, build-evidence tooling, and vulnerability matching are public today at github.com/bomwerk/bomwerk under Apache-2.0. What you can actually do with that today, what's still commercial and still in preview, and why there's a public adversarial test repo you're invited to try to break it with.
-
Four Feeds, But Only One Starts the Clock
OSV, NVD, CISA KEV, ENISA EUVD: bomwerk's own materials list all four as vulnerability sources, which makes it sound like some kind of weighted-voting merge happens behind the scenes. It doesn't. Each feed answers a different question, one of them isn't wired up yet, and only one of them is what actually triggers the CRA's 24-hour clock.
-
AI Coding Tools Are Now a Primary Attack Target. bomwerk Never Calls One.
Google's Threat Intelligence Group warned this month that AI-assisted coding tools have become a primary target for threat actors, with malware specifically designed to hide in the project directories those tools use. What the report actually found, and why a scanner that never calls a cloud AI service isn't part of that attack surface.
-
The Reporting Platform Is Live. Do You Know What You're Reporting On?
ENISA turned on the CRA Single Reporting Platform today, 11 September 2026, the same day the reporting obligation became active. Filing is genuinely simpler now: one submission, not twenty-seven. But the platform doesn't know what's inside your product, and that question was never its job to answer.
-
11 September: The 24-Hour Clock Starts. Here's What Actually Changes.
From 11 September 2026, EU manufacturers must report actively exploited vulnerabilities within 24 hours of becoming aware, and that applies to products already on the market, not just new ones. What 'aware' actually means, a worked timeline of the reporting cascade, and the three things that need to already be in place before the clock starts, because you can't build them during an incident.
-
There's No Database Server Behind bomwerk. On Purpose.
A lot of on-prem security tools quietly ask you to stand up a database before you can even run them. That's a Postgres instance to patch, a port to open, a service account to manage, on top of the tool itself. Why we store local state in SQLite instead, what that decision buys you, and where it stops being the right call.
-
Never Crash Is a Promise. Here's How We Test It.
Every parser in bomwerk returns a result instead of throwing. That's the claim from last week's post. A claim like that only means something if you can catch the moment it breaks. What a golden corpus of real repos checks that unit tests miss, one fuzz target per parser, and why undefined behavior in an archive reader is a security question, not just a correctness one.