One app is one named project — typically one repository. Multiple branches or versions of the same repo count as one app. The CLI and GitHub Action can scan unlimited repos locally; the limit only applies to apps tracked in the hosted dashboard.
Yes. The CLI and GitHub Action are open source and free for local generation and export. Paid plans add hosted ingestion, central tracking, history, alerts, and team features via the API.
npm (package-lock.json, yarn.lock), Python (Pipfile.lock, poetry.lock), Rust (Cargo.lock), and Go (go.sum). Docker image base-layer auditing is also included. More ecosystems are in progress — check the docs for the latest.
Add the SBOMix GitHub Action to your workflow. On each PR it generates an SBOM and diffs it against the base branch. If new critical CVEs are introduced, the check fails and the merge is blocked. You control the threshold (critical-only, or critical + high). Available on Team and above.
You'll get an email heads-up before you hit limits, and a prompt to upgrade in the dashboard. We don't cut off access or delete data without warning. Hard blocks only apply to clear abuse cases.
Yes — 14 days free on Hosted, Team, and Business. No credit card required for Free or for the trial. Business trials are also available on request via sales.
Yes. Monthly plans can be cancelled any time — access continues until the end of the billing period. Annual plans are non-refundable after 30 days but can be upgraded at any time with prorated credit applied.
Yes. Approved open-source projects can apply for a free plan with expanded limits. Email hello@sbomix.com with a link to your repo.