Product security evidence for the teams that ship connected devices
EmbedHarbor helps IoT and embedded device manufacturers connect software inventories, supplier components, product versions and security evidence. The free browser tools make the first checks available today; the connected workflow is being built with design partners.
What EmbedHarbor is
A product security workspace for connected devices, plus a set of free checks that work without an account. The checks answer narrow questions — is this SBOM structurally valid, can its components be matched, what changed between releases, does the CRA likely apply. The workspace is where those answers are meant to stay attached to the product version.
It is not a scanner that promises full vulnerability coverage, and it is not a compliance certificate. A component match is a lead for review; a validated file is a starting point, not a security result.
Our mission
Make security evidence something a device manufacturer can produce, inspect and defend — without uploading the family jewels to a stranger's server, and without turning uncertainty into a score.
The practical test is simple: can an engineer answer a customer questionnaire or a supplier advisory with a document that shows what is in the product, which version it belongs to, and what was decided? If the answer takes a week of spreadsheet archaeology, the tooling is not doing its job.
Built for the people who have to produce the evidence
Not a generic security buyer. The work happens in firmware builds, supplier folders and release reviews.
IoT OEMs and device manufacturers
Products with a multi-year support period, supplier modules and OTA updates.
Firmware engineering teams
Buildroot, Yocto and vendor SDKs, where the inventory is generated at build time.
Product security and CRA teams
Scope, technical documentation, review decisions and a defensible evidence trail.
Our approach
Browser-local by default. The free tools run in your tab. An SBOM describes exactly what an attacker would look for; uploading it to get a free opinion is a supply-chain decision, not a convenience.
Status labels, not marketing confidence. Every capability on this site is Available now, Early Access or Planned. “Early Access” means a small group is using it and it is not generally available. “Planned” means it does not exist. We do not have a fourth category for “we could demo it if you asked”.
Limits stated before the result. A schema pass is not a vulnerability result. A decoded certificate is not a verified chain. A diff is not an impact assessment. Each tool says what it does not prove, on the page, not only in a footnote.
Read the claims, then check them
If a claim here does not match the product, that is a bug. The current public capabilities are listed below with their real status.
| Capability | Status | Where |
|---|---|---|
| SBOM validation and query readiness | Available now | SBOM Validator |
| Two-release SBOM comparison | Available now | SBOM Diff |
| Indicative CRA scope and role | Available now | CRA Scope Checker |
| Local X.509 field decoding | Available now | X.509 Decoder |
| Product-version and supplier traceability | Early Access | Product & Supply Chain Security |
| Release authorisation and signing workflow | Planned | Trusted Delivery |
Talk to us
Product questions, Early Access, security disclosure or legal and privacy requests all go to one public address. No contact form, no sales sequence.
Where we are
EmbedHarbor is an early-stage product with a working free toolset and a design-partner programme. This website is static and independent of the application: it keeps working when nothing else is running. The operating entity and its legal status are on the legal page.