A Software Bill of Materials (SBOM) is a structured inventory of all components that make up a piece of software — including third-party libraries, packages, versions, and their relationships. SBOMs help organizations understand what is inside their software, evaluate exposure to known vulnerabilities, and meet supply-chain security and compliance requirements.
We publish SBOMs because transparency and security are core to Defguard. Making our dependency information public lets customers and auditors independently verify what we ship, continuously assess risk against public CVE databases, and integrate our artifacts into their own security tooling and compliance workflows. SBOMs also help us respond faster to newly disclosed issues: we track and scan dependencies after each release, prioritize remediation, and communicate status openly. This practice aligns with ISO 27001 controls and demonstrates our commitment to a secure software supply chain.
Separate SBOMs are available for mobile apps (Android, iOS), the desktop app (Windows, macOS, Linux), and server components (Core, Proxy, Gateway). Alongside each SBOM, advisories files are also published to summarize known vulnerabilities in detail.
We use Trivy to generate SBOM files and scan for vulnerabilities in our dependencies. Each SBOM is updated every day in our CI/CD pipeline and provided in the standard SPDX format.
Component
Version
Date checked
Links
Vulnerability status
Status
Active vulnerabilities
react-router: React Router: Open redirect vulnerability via specially crafted URLs
DeepmergeTS has stack exhaustion when merging recursive object graphs
react-router: React Router: Open redirect vulnerability via specially crafted URLs
react-router: React Router: Information disclosure via client-side constructor execution
react-router: React Router: Open Redirect vulnerability via backslashes in navigation components
react-router: react-router-dom: React Router: Cross-Site Scripting (XSS) via open redirects
Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`
Quinn: Remote memory exhaustion in quinn-proto from unbounded out-of-order stream reassembly
serde_with: KeyValueMap serialization panics on empty sequence or map entries
