Usually not as a formal document, but you do need to know what your site or app is made of. An SBOM, or software bill of materials, is a list of the components inside software. If you build or commission code, keep a simple, current list and know who updates it.
What an SBOM is
An SBOM lists the libraries, plugins and packages that make up an application, with versions. Think of an ingredients label. When a flaw is announced in a library, the list tells you quickly whether you use it.
Most small nonprofit sites are built on a content management system, a theme and a handful of plugins, or on a website builder. In those cases, your "parts list" is the plugin list and the platform version.
When you need one
| Your situation | Do you need an SBOM? |
|---|---|
| Website builder, no code | No. Keep a list of add ons and who manages them |
| CMS with plugins | A plugin list with versions is enough to start |
| Custom app by a volunteer or agency | Yes, a dependency list from the build tools |
| Selling to a funder or agency that asks | Possibly. Ask what format they accept |
| Publishing open source | Helpful for your users |
If a funder or government partner requires one, ask what format and what level of detail. Do not assume.
How to make a simple list
- Ask your developer. Request the dependency files from the project, such as a lockfile or a manifest.
- Generate a list. Many tools can produce an SBOM from those files. Pick one that outputs a standard format.
- Store it. Keep the file with the project and record the date.
- Refresh it. Regenerate it when dependencies change, and at least quarterly.
- Check it. Compare the list against known vulnerability data.
The point of the list is use. A file nobody reads does not help.
What an SBOM does not tell you
It does not say whether a vulnerability is exploitable in your app, whether your configuration is safe, or whether a plugin's author is trustworthy. It starts the conversation. See why a clean scan does not mean software is safe.
Try it yourself
Click through it at your own pace, or open it full screen. Look at how packages and versions are listed, which is what an SBOM captures.
Where Safeguard fits
Safeguard provides SBOM and dependency scanning, plus a free scan you can try at gold.safeguard.sh/scan.
Ask your agency or volunteer developer
If someone else builds your site, put the request in writing: "Please give us a list of the components and versions used, and tell us how you will tell us about security updates." A good developer can answer in a day. If they cannot, that is useful information about how well your site is maintained.
Also ask who has the code and the hosting login. An SBOM is little help if only one person can open the project.
Quick check
Is an SBOM a security report?
No. It is an inventory. You still need to compare it against vulnerability data and act on the results.
Who should own the list?
Whoever maintains the code or the website. Name a person and a backup in your account list.
Last reviewed: 19 October 2026.
