Phase 6: Supply Chain Security & Slopsquatting · 50 min · pip-audit · npm audit · cyclonedx

SBOM for AI Code

If you don't know what's in your AI codebase, you can't secure it. Generate an SBOM.

Real-world application: Engineers who can generate SBOMs and perform dependency-tree analysis for AI codebases address the CSA recommendation for AI code production readiness.

What you will learn

Generate a Software Bill of Materials (SBOM) for AI-generated codebases
Use pip-audit and npm audit for dependency vulnerability scanning
Perform dependency-tree analysis to identify transitive risks
Understand the CSA recommendation: require SBOM for all AI-generated codebases entering production

Introduction

SBOM for AI Code

Objective

Run the SBOM generator on an AI-generated codebase with 10 dependencies. Observe the SBOM entries, dependency tree analysis, vulnerability scan results, and CSA compliance check. Identify hallucinated packages, unknown licenses, and vulnerable versions.

If you don't know what's in your AI codebase, you can't secure it. Generate an SBOM.

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers The Problem, The Concept, Build, Check Yourself, Key Terms & Next — plus a hands-on lab, quiz, and project artifact.

Create a free account — the opening phases of 29 of 35 courses are free, no credit card.