A web application for uploading, parsing, and exploring Software Bill of Materials (SBOMs). The app extracts components from SBOM JSON files (CycloneDX / SPDX-style) and makes them searchable across projects.

Built with Next.js (App Router), TypeScript, PostgreSQL, and Prisma.

• Upload SBOM JSON files
• Parse and normalize components into a relational database
• Browse SBOMs by project
• Search SBOMs by component name
• View SBOM details and component lists
• Paginated component tables
• Delete SBOMs
• Authentication using NextAuth (Credentials provider)

• Next.js (App Router)
• React
• TypeScript
• Tailwind CSS

• Next.js API Routes
• NextAuth / Auth.js
• Prisma ORM
• PostgreSQL

• Prisma Migrate
• ESLint
• Prettier
• **Node.js 18+

1️⃣ Prerequisites

• Node.js 20.19+
• Docker (recommended for PostgreSQL)
• npm or pnpm

2️⃣ Clone the repository

3️⃣ Install dependencies

npm install

This project includes a docker-compose.yml file to run PostgreSQL locally.

docker compose up -d

This starts a PostgreSQL 16 container with:

• Database: sbom_browser
• Username: postgres
• Password: postgres
• Port: 5432

docker compose down

To stop and remove all data:

docker compose down -v

4️⃣ Configure environment variables

Create a .env file in the root:

DATABASE_URL="postgresql://postgres:postgres@localhost:5432/sbom_browser"
NEXTAUTH_SECRET="super-secret-key"
NEXTAUTH_URL="http://localhost:3000"

5️⃣ Set up the database

Run Prisma migrations and generate the client:

npx prisma migrate dev
npx prisma generate

(Optional) View the database:

npx prisma studio

6️⃣ Run the development server

npm run dev

Open your browser at:

http://localhost:3000

1. Register a user account
2. Log in
3. Registered user will have a project called Default
4. Upload an SBOM JSON file
   • User has the option to create a project in the Upload modal
5. Browse and search components
6. View SBOM details and components
7. Delete SBOMs when no longer needed

The parser currently supports:

• CycloneDX-style JSON
• SPDX-style JSON (basic support)

Unsupported or malformed files will be rejected gracefully.

• Uses NextAuth Credentials Provider
• Passwords are hashed with bcrypt
• Session strategy: JWT

Login page:

Register page:

Sbom Component Browser Empty Dashboard:

Upload Modal:

Sbom List:

Search Component Name:

Component Detail: