Phase 6: Supply Chain Security & Slopsquatting · 50 min · pip-audit · npm audit · cyclonedx

SBOM for AI Code

If you don't know what's in your AI codebase, you can't secure it. Generate an SBOM.

Hiring signal: Engineers who can generate SBOMs and perform dependency-tree analysis for AI codebases address the CSA recommendation for AI code production readiness.

What you will learn

Generate a Software Bill of Materials (SBOM) for AI-generated codebases
Use pip-audit and npm audit for dependency vulnerability scanning
Perform dependency-tree analysis to identify transitive risks
Understand the CSA recommendation: require SBOM for all AI-generated codebases entering production

The Problem

An SBOM (Software Bill of Materials) is a formal inventory of all components in a software project -- direct dependencies, transitive dependencies, versions, licenses, and vulnerabilities. For AI-generated codebases, an SBOM is critical because AI introduces dependencies that developers may not be aware of. The Cloud Security Alliance (CSA) recommends requiring an SBOM for all AI-generated codebases entering production.

What is an SBOM?

An SBOM is a machine-readable file (JSON or XML) that lists:

Field	Description
Package name	Name of the dependency
Version	Installed version
Supplier/Publisher	Who maintains the package
License	Software license (MIT, Apache, GPL)
Dependencies	Transitive dependencies
Vulnerabilities	Known CVEs
Checksum/Hash	Integrity verification

SBOM Formats

Format	Standard	Use Case
CycloneDX	OWASP	Security-focused, rich vulnerability info
SPDX	Linux Foundation	License compliance focused
Syft	Auto-generated	Multi-format output

Unlock the full lesson

You've read the first 2 sections. The rest of this lesson covers Generating SBOMs, The CSA Recommendation, Build It — plus a hands-on lab, quiz, and project artifact.

Create a free account to unlock Phase 0 and Phase 1 of every course — no credit card.