What Bomdesk does
Drop a lockfile and get the licence and known-advisory picture of every dependency, plus a CycloneDX or SPDX SBOM to send to the customer who asked.
A customer security questionnaire asks for an SBOM. A legal review asks whether anything in the product is GPL. A scanner flags a package you have never heard of. All three questions are answered by the same file: your lockfile lists every package, including the transitive ones, at the exact version you ship. Bomdesk reads that file in your browser and turns it into the answers.
It understands package-lock.json (all three lockfile versions), yarn.lock (classic and Berry), pnpm-lock.yaml, pinned requirements.txt, go.mod, go.sum and Cargo.lock. Licences are read as SPDX expressions, so an OR is treated as your choice and an AND as an obligation that applies; anything that is not a real SPDX licence is shown as Unknown rather than guessed. Known advisories come from the OSV database for the exact versions, with a severity computed from the CVSS vector and the version that fixes it. The result downloads as CycloneDX 1.5 or SPDX 2.3 JSON, both checked against the official schemas, or as a CSV.
Only package names and versions leave your browser, and only when you press Scan. The free tool does everything for the first 250 packages and writes the SBOM for all of them. Pro is $19 once: look up every package, set a licence and advisory policy, compare two lockfiles, and export a Markdown report. Licence classes are a reading aid, not legal advice.
Popular uses
Each opens Bomdesk already set up for that job, with steps and answers for that case.
Free vs Pro
| Feature | Free $0 · no account |
Pro |
|---|---|---|
| Reads package-lock.json, yarn.lock, pnpm-lock.yaml, pinned requirements.txt, go.mod, go.sum and Cargo.lock in your browser | Included | Included |
| Licence of every package, read as an SPDX expression and sorted into permissive, weak copyleft, strong copyleft, network copyleft, restricted or unknown | Included | Included |
| Known advisories for the exact versions, with severity scored from the CVSS v3 vector and the fixed version | Included | Included |
| CycloneDX 1.5 and SPDX 2.3 JSON that validate against the official schemas, plus a CSV licence table | Included | Included |
| Runtime support check against endoflife.date for Node.js, Python, Go, Ruby, PHP and .NET | Included | Included |
| Look up licences and advisories for every package (free looks up the first 250, direct dependencies first) | — | Pro |
| Licence and advisory policy with a pass/fail list | — | Pro |
| Compare two lockfiles or SBOMs: what was added, removed or moved to another version | — | Pro |
| Dependency report in Markdown for a customer, auditor or pull request | — | Pro |
Pro is $19, paid once. Checkout and the licence key are handled by Dodo Payments (merchant of record). By buying you agree to the Terms and Privacy Policy.
Questions
Is Bomdesk free?
Yes, with no account and no install. The free plan includes: Reads package-lock.json, yarn.lock, pnpm-lock.yaml, pinned requirements.txt, go.mod, go.sum and Cargo.lock in your browser; Licence of every package, read as an SPDX expression and sorted into permissive, weak copyleft, strong copyleft, network copyleft, restricted or unknown; Known advisories for the exact versions, with severity scored from the CVSS v3 vector and the fixed version; CycloneDX 1.5 and SPDX 2.3 JSON that validate against the official schemas, plus a CSV licence table; and 1 more. Pro ($19, paid once) adds: Look up licences and advisories for every package (free looks up the first 250, direct dependencies first); Licence and advisory policy with a pass/fail list; Compare two lockfiles or SBOMs: what was added, removed or moved to another version; Dependency report in Markdown for a customer, auditor or pull request.
Does Bomdesk upload my data?
No. The lockfile you drop is read in your browser and never uploaded to us. When you press Scan, package names and versions (not the file) are sent from your browser to deps.dev and OSV to look up licences and advisories; you can untick that to stay fully offline. We only measure which buttons are used. See the Privacy Policy for retention and deletion.
Do I need to install anything?
No. Open the page and start working. It works on desktop and mobile browsers.
How does the Pro licence work?
You pay once and receive a licence key by email from Dodo Payments (our merchant of record). Paste it under "Have a key?" inside the tool. One key works on up to 3 browsers; you can release a browser at any time to use the key elsewhere.
What is an SBOM?
A software bill of materials is a machine-readable list of the components in a piece of software, with their versions and licences. CycloneDX and SPDX are the two common formats. A lockfile is the best starting point because it lists the exact versions that were installed.
Is my lockfile uploaded anywhere?
No. The file is parsed in your browser. When you press Scan, only the package names and versions are sent to deps.dev and OSV. Untick the lookup box and nothing is sent at all.
Why is a licence shown as Unknown?
Because the package does not state a standard SPDX licence. Values such as BSD, Apache 2 or SEE LICENSE IN a file cannot be mapped without guessing, so Bomdesk leaves them as Unknown and shows the raw text.
Does "no known advisories" mean a package is safe?
No. It means the OSV database lists none for that exact version today. New advisories appear over time, so rerun the scan before you rely on it.
