Skip to main content

​
Software Bill of Materials (SBOM)

Nextedy maintains a complete inventory of all third-party components included in its products. The SBOM is generated in an industry-standard format: The SBOM covers every third-party component shipped with the products, including open-source libraries, OSGi framework dependencies, and utility packages.

​
Continuous Vulnerability Scanning

Every build generates a CycloneDX SBOM with Syft; release SBOMs are then ingested into Dependency-Track for continuous vulnerability monitoring. The process:
  1. SBOM generation — Syft scans the source tree on every build and produces a CycloneDX SBOM, archived alongside the build.
  2. Alert routing — New vulnerabilities are flagged immediately and routed to the security team.
  3. Triage — Each finding is assessed for exploitability in the context of the Polarion product environment.
  4. Remediation — Critical and high findings are patched according to the incident management SLAs. Lower-severity findings are addressed in the next scheduled release.

​
FOSS and COTS Reporting

For each third-party component, Nextedy tracks:
  • Component name and version
  • License type (e.g., Apache 2.0, MIT, EPL)
  • Known vulnerabilities (from Dependency-Track’s CVE feeds, including NVD)
  • Usage context (what the component is used for in the product)
This information supports customer procurement processes and regulatory submissions where a full software composition analysis is required.

​
Release Security Gate

Every Nextedy release passes through a security gate before publication:
  1. SAST scan — SonarQube analyses the source and exports a Security Hotspots report.
  2. Dependency review — The release SBOM is ingested into Dependency-Track and its findings are reviewed.
  3. SBOM generation — An updated CycloneDX document is produced and archived.
  4. Review — The security team signs off on the scan results and SBOM accuracy.
Critical and high findings are triaged and must be resolved or explicitly accepted before a release is approved.

​
Relevance for Regulated Industries

Supply chain transparency is a regulatory requirement in several industries where Nextedy products are deployed:
  • Automotive — ISO/SAE 21434 requires cybersecurity management of third-party software components. UNECE WP.29 R155 mandates supply chain risk management.
  • Aerospace — DO-178C and DO-330 require identification and verification of COTS and reusable software components.
  • Medical devices — IEC 62304 requires documentation of SOUP (Software of Unknown Provenance) components with risk assessment.
Nextedy’s SBOM and continuous scanning process provide the evidence needed to satisfy these requirements.
SBOM documents in CycloneDX format are available on request. Contact security-alerts@nextedy.com to obtain the latest SBOM for your Nextedy product version.
Last modified on August 20, 2026