Vulnerability tracking

bifrost tracks known vulnerabilities (CVEs) in your services using SBOMs (Software Bill of Materials). For each service version, bifrost looks up CVEs for its components and keeps tracking them over time.

Submit both image and code SBOMs

For a complete view of a service, submit two SBOMs per service version:

• Code SBOM: the application dependencies, generated from your source code or build. This captures the libraries your application uses directly.
• Image SBOM: the contents of the container image, including the base image and OS packages.

Neither SBOM covers the other. A code SBOM misses vulnerable OS packages in the base image, and an image SBOM can miss or misidentify application dependencies.

Get started

1. Generate a code SBOM as part of your build. See Generating SBOMs for tools.
2. Submit the code SBOM for your service version, using one of:
   • The submit-sbom-action in GitHub Actions.
   • The bifrost CLI from any CI/CD pipeline or workstation.
   • The integration API.
3. Let bifrost generate image SBOMs. bifrost automatically generates SBOMs for public images running in your environments. For images in private registries, set up Registry access. If bifrost cannot reach your registry, generate the image SBOMs yourself and submit them like the code SBOM.
4. View the vulnerabilities in the bifrost portal under your service version.

See the SBOM reference for supported formats and how vulnerability analysis works.