Tools

Open source management tools I contribute to. They cover SBOM generation, open source risk analysis, vulnerability and license management, and notice generation.

Click a card to go to its GitHub repository or page.

BomLens

A local-first SBOM generator and open source risk assessor (CycloneDX). Produces an SBOM, an open source notice, and a security and license risk report from source, containers, binaries, firmware, or an existing SBOM. CLI or web UI, no SaaS.

github.com/sktelecom/bomlens

TRUSCA

A self-hosted, open source SCA portal. Vulnerability (CVE), license compliance, and SBOM management in one UI. Black Duck and Snyk class capabilities, Apache-2.0.

github.com/trustedoss/trusca

onot

Generate open source notices (OSS Notice) from SBOM documents (SPDX, CycloneDX, Excel) to HTML, Text, Markdown, or PDF. Offline, type-safe Python core with CLI, local API, and an installable desktop app.

github.com/sktelecom/onot

SCA Benchmark

A leaderboard that measures the accuracy of SCA (software composition analysis) tools against human-curated ground truth. It compares 10 open source tools across dependencies, container images, binaries, file licenses, reachability, AI model files, and SBOM quality. The page is in Korean and discloses that its operator maintains BomLens.

Leaderboard, 2026-10 round

Last modified October 15, 2026