Decide what to ask your supplier to fix before accepting an SBOM.
Free tool: results are indicative and are not a certification. Use is subject to the Terms of service and the Privacy policy.
What is the Supplier SBOM Acceptance?
For IoT OEMs, device manufacturers and product security teams receiving upstream inventories.
Ready means no blocking or warning findings under EmbedHarbor Supplier Acceptance Policy v1. Needs Review requires a human decision. Rejected identifies blocking technical issues. Optional fields are not legal requirements.
| Accepted input | CycloneDX JSON 1.4, 1.5, 1.6 · SPDX 2.3 JSON |
|---|
| Enforced limits | 5 MB per file · 20 MB per request including upload framing · 20,000 total components · JSON depth 64 · One file per run · External documents are not retrieved or verified · Applicability of missing identifiers needs human review |
|---|
| Processing | Explicit upload to EmbedHarbor · temporary processing · no account required |
|---|
| Not included | Technical document analysis only. No signatures, supplier authenticity, legal compliance or current vulnerability exposure are verified. |
|---|
How it works
- Choose inputs. Select JSON SBOMs or download the synthetic examples. Review the file limits and upload notice.
- Upload & Analyze. The existing EmbedHarbor API validates the request and runs the internal offline analysis engine.
- Review the result. Ready means no blocking or warning findings under EmbedHarbor Supplier Acceptance Policy v1. Needs Review requires a human decision. Rejected identifies blocking technical issues. Optional fields are not legal requirements.
- Download your report. Keep the report and engine versions with the delivery. Processing does not create a SaaS product or version.
What it checks
- Schema validity and sbomqs information quality
- Names, versions, suppliers and applicable identifiers
- Duplicate references and unresolved dependency endpoints
- Versioned policy classifications: Blocking, Warning, Informational, Not Applicable and Not Evaluated
Common errors and fixes
The file is not supported
Use a supported JSON SBOM version; archives, XML and tag-value files are rejected.
Analysis is unavailable or timed out
Retry later or reduce the input size. A failed analysis is never displayed as a clean result.
The result needs review
Inspect the structured findings. An unevaluated check does not mean it passed.
Example output
The result is a structured report. This is the shape of the output you can export; the example reports show the full engine output for a synthetic firmware SBOM.
ruleVersion: EmbedHarbor Supplier Acceptance Policy v1
summary: acceptance, schemaValid, score
findings: classification, location, recommendation
Privacy and data handling
Clicking Upload & Analyze sends the selected SBOMs to EmbedHarbor for this request. Temporary files are deleted after processing; reports remain in your browser until you leave. No third-party analysis service receives the files. Do not upload secrets.
Frequently asked questions
Can I forward the feedback to my supplier?
Yes. Download Supplier Feedback Report includes the policy, engine versions, technical findings and suggested remedies so both parties can reproduce the review.
Are files sent to third-party analysis platforms?
No. Analysis runs within EmbedHarbor using bundled open-source engines and schemas. External SBOM links are not fetched.
