A Software Bill of Materials (SBOM) is a structured inventory of all components that make up a piece of software — including third-party libraries, packages, versions, and their relationships. SBOMs help organizations understand what is inside their software, evaluate exposure to known vulnerabilities, and meet supply-chain security and compliance requirements.
We publish SBOMs because transparency and security are core to Defguard. Making our dependency information public lets customers and auditors independently verify what we ship, continuously assess risk against public CVE databases, and integrate our artifacts into their own security tooling and compliance workflows. SBOMs also help us respond faster to newly disclosed issues: we track and scan dependencies after each release, prioritize remediation, and communicate status openly. This practice aligns with ISO 27001 controls and demonstrates our commitment to a secure software supply chain.
Separate SBOMs are available for mobile apps (Android, iOS), the desktop app (Windows, macOS, Linux), and server components (Core, Proxy, Gateway). Alongside each SBOM, advisories files are also published to summarize known vulnerabilities in detail.
We use Trivy to generate SBOM files and scan for vulnerabilities in our dependencies. Each SBOM is updated every day in our CI/CD pipeline and provided in the standard SPDX format.
Component
Version
Date checked
Links
Vulnerability status
Status
Active vulnerabilities
follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering
follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects
source-map-js: source-map-js: Denial of Service via malformed indexed source maps
launch-editor: launch-editor: Command injection via improper file path validation
launch-editor: launch-editor: Arbitrary code execution via improper argument escaping on Windows
launch-editor: launch-editor: Arbitrary command execution via improper filename handling
vite: Vite: Information disclosure via improper module path handling
vite: vite: Information disclosure via crafted WebAssembly query parameter
vite: vite: Arbitrary script execution via improper URL handling during HTML transformation
Active vulnerabilities
Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
axios: axios: Security control bypass via unapplied HTTP/2 proxy and DNS settings
axios: Axios: Denial of Service via unhandled error in HTTP/2 session initialization
axios: Axios: Denial of Service via malformed data URLs
axios: axios: Request socket hijacking via inherited createConnection property
axios: axios: Denial of Service via crafted redirect hostname
axios: Axios: Server-Side Request Forgery via bypassed redirect restrictions in fetch adapter
axios: axios: Denial of Service via prototype pollution gadget in form serialization
axios: Axios: Information disclosure via improper CIDR proxy bypass handling
axios: Axios: Outbound HTTP header injection via prototype pollution in fetch adapter
axios: axios: Unintended HTTP method override via prototype pollution gadget
axios: Axios: HTTP header injection via inherited prototype properties
axios: Axios: Outbound HTTP request manipulation via fetch adapter prototype pollution
follow-redirects: follow-redirects: Information disclosure via improper regular expression escaping in sensitive header filtering
follow-redirects: follow-redirects: Information disclosure via array-formatted headers during cross-origin redirects
seroval: Seroval: `fromJSON()` Promise thenable assimilation invokes plugin-produced callables (bypass of CVE-2026-59940)
seroval: seroval: Denial of Service via unbounded memory allocation during deserialization
Active vulnerabilities
Rustls: TLS 1.3 handshake messages incorrectly accepted across encryption level boundaries
Active vulnerabilities
source-map-js: source-map-js: Denial of Service via malformed indexed source maps
Upstream / suppressed findings
Unsoundness in `Iterator` and `DoubleEndedIterator` impls for `glib::VariantStrIter`
Explanation: glib is a transitive dependency of Tauri which we cannot update ourselves. Waiting for tauri to finish migration to gtk4-rs: https://github.com/tauri-apps/tauri/issues/12563
