You can, but be selective and be open about it. Reporting on the 2026 CISA minimum elements says authors must offer a process for recipients to ask about redacted data, and organizations may treat an SBOM as incomplete if essential component data is withheld.
Why teams want to redact
Reasons are usually fair. Internal package names can reveal architecture. Private repository URLs are not for outsiders. A component list can hint at an unannounced product, or at a technology choice a competitor would like to know. Some customers will receive the file and pass it along.
What the guidance says
As reported by FOSSA, the 2026 text tells authors to provide a process for recipients to ask about redacted data, and says organizations may treat an SBOM as incomplete if essential component data is withheld. It also expects unknown provenance and unknown versions to be marked rather than hidden.
So redaction is tolerated, but not free. The more you hide, the less the SBOM is worth to the buyer.
What is usually safe to remove
- Credentials or tokens that landed in a URL. Remove these always, and fix the generator.
- Internal hostnames and private repository paths.
- Names of internal only packages that are not part of what the customer receives.
What buyers need to see
The fields the buyer uses to match vulnerabilities and check licenses: component name, version, identifiers, producer, license, and hashes. Hiding those defeats the purpose.
A way to decide
- List every field you want to withhold.
- For each, ask whether the buyer needs it to assess risk in the product they receive.
- If yes, keep it, or share it under an NDA.
- If no, remove it and note the category you removed.
- Describe the redaction in the cover note, and name a contact for questions.
Alternatives to redaction
Share a fuller SBOM under an agreement, and a shorter one publicly. Or provide a filtered view that contains only what ships in the delivered artifact. Another option is to answer targeted questions, such as "is component X in your product", without sending the file.
Sharing safely
Whatever you send, review it for secrets before it leaves. Generators sometimes capture build paths and URLs that you did not intend to publish. Our post on what to send when a customer asks for your SBOM covers the request side.
Quick check
Will redaction make my SBOM invalid?
Not automatically, but a recipient may treat it as incomplete if essential data is missing, per the reported guidance.
What should I always remove?
Credentials and tokens, and anything that should never have been in the file.
Sources
Last reviewed: 19 October 2026.
