# gururaj-s-cse/sbom architecture

> Architecture diagram of the GitHub repository gururaj-s-cse/sbom, generated by GitDiagram from its file tree, README and a sample of source files (last updated 2026-09-30). It is an AI-made overview: check details against the source.

- Interactive diagram: https://gitdiagram.com/gururaj-s-cse/sbom
- Repository: https://github.com/gururaj-s-cse/sbom

## Overview

SBOM Analyzer accepts software bills of materials and presents component, vulnerability, license, dependency, maintenance, and risk findings, including cross-application correlation and reports. The main documented workflow is upload, parse, analyze, and review results. The backend report service orchestrates the analysis stages; separate backend routes also expose upload, vulnerability, license, and correlation endpoints. The README is only a title, so product capabilities are inferred from the sampled source and frontend labels. Frontend-to-backend wiring is not shown in the excerpts; that connection is marked unverified.

Main entry points: [`backend/app.py`](https://github.com/gururaj-s-cse/sbom/blob/main/backend/app.py) (Flask API), [`backend/services/report_service.py`](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/report_service.py) (Report Orchestrator), [`frontend/src/App.jsx`](https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/App.jsx) (Application Router), [`backend/services/correlation_service.py`](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/correlation_service.py) (Application Correlation)

## Diagram (Mermaid)

```mermaid
flowchart TD

subgraph group_frontend["Frontend"]
  node_app["Application Router<br/>[App.jsx]"]
  node_upload_page["Upload Page<br/>[Upload.jsx]"]
  node_upload_box["SBOM Upload<br/>[UploadBox.jsx]"]
  node_api_client["API Client<br/>[api.js]"]
  node_results_page["Analysis Results<br/>[Results.jsx]"]
  node_dashboard_page["Dashboard<br/>[Dashboard.jsx]"]
  node_graph_page["Graph View<br/>[Graph.jsx]"]
  node_report_page["Executive Report<br/>[Report.jsx]"]
end

subgraph group_backend["Backend API"]
  node_backend_api["Flask API<br/>[app.py]"]
  node_applications["Application Registry<br/>[applications.json]"]
end

subgraph group_analysis["SBOM Analysis"]
  node_sbom_parser["SBOM Parser<br/>[parser.py]"]
  node_report_service["Report Orchestrator<br/>[report_service.py]"]
  node_vulnerability_check["Vulnerability Scan"]
  node_license_check["License Audit<br/>[license_checker.py]"]
  node_maintenance_check["Maintenance Check"]
  node_risk_score["Risk Scoring<br/>[risk_score.py]"]
  node_dependency_graph["Dependency Graph"]
  node_vulnerability_db["Vulnerability Data"]
  node_license_rules["License Rules<br/>[license_rules.json]"]
end

subgraph group_correlation["Cross-System Analysis"]
  node_correlation_service["Application Correlation"]
end

node_user(("Security Analyst"))

node_user -->|"uses"| node_app
node_app -->|"routes to"| node_upload_page
node_app -->|"routes to"| node_results_page
node_app -->|"routes to"| node_dashboard_page
node_app -->|"routes to"| node_graph_page
node_app -->|"routes to"| node_report_page
node_upload_page -->|"renders"| node_upload_box
node_upload_box -.->|"uses"| node_api_client
node_api_client -.->|"requests"| node_backend_api
node_backend_api -->|"loads"| node_applications
node_backend_api -->|"parses upload"| node_sbom_parser
node_backend_api -->|"generates report"| node_report_service
node_backend_api -->|"builds graph"| node_dependency_graph
node_backend_api -->|"checks vulnerabilities"| node_vulnerability_check
node_backend_api -->|"checks licenses"| node_license_check
node_backend_api -->|"gets correlations"| node_correlation_service
node_report_service -->|"parses SBOM"| node_sbom_parser
node_report_service -->|"checks licenses"| node_license_check
node_report_service -->|"checks vulnerabilities"| node_vulnerability_check
node_report_service -->|"checks maintenance"| node_maintenance_check
node_report_service -->|"calculates score"| node_risk_score
node_report_service -->|"builds attack paths"| node_dependency_graph
node_vulnerability_check -->|"reads"| node_vulnerability_db
node_license_check -->|"reads"| node_license_rules
node_correlation_service -->|"parses app SBOMs"| node_sbom_parser
node_correlation_service -->|"checks vulnerabilities"| node_vulnerability_check
node_correlation_service -->|"checks licenses"| node_license_check
node_correlation_service -->|"checks maintenance"| node_maintenance_check
node_results_page -.->|"displays analysis"| node_backend_api
node_graph_page -.->|"displays graph"| node_dependency_graph
node_report_page -.->|"displays report"| node_report_service

click node_app "https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/App.jsx"
click node_upload_page "https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Upload.jsx"
click node_upload_box "https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/components/UploadBox.jsx"
click node_api_client "https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/api/api.js"
click node_results_page "https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Results.jsx"
click node_dashboard_page "https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Dashboard.jsx"
click node_graph_page "https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Graph.jsx"
click node_report_page "https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Report.jsx"
click node_backend_api "https://github.com/gururaj-s-cse/sbom/blob/main/backend/app.py"
click node_sbom_parser "https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/parser.py"
click node_report_service "https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/report_service.py"
click node_vulnerability_check "https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/vulnerability_service.py"
click node_license_check "https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/license_checker.py"
click node_maintenance_check "https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/maintenance_checker.py"
click node_risk_score "https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/risk_score.py"
click node_dependency_graph "https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/dependency_graph.py"
click node_correlation_service "https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/correlation_service.py"
click node_applications "https://github.com/gururaj-s-cse/sbom/blob/main/backend/sample_data/applications.json"
click node_vulnerability_db "https://github.com/gururaj-s-cse/sbom/blob/main/backend/sample_data/vulnerability_db.json"
click node_license_rules "https://github.com/gururaj-s-cse/sbom/blob/main/backend/sample_data/license_rules.json"

classDef toneNeutral fill:#f8fafc,stroke:#334155,stroke-width:1.5px,color:#0f172a
classDef toneBlue fill:#dbeafe,stroke:#2563eb,stroke-width:1.5px,color:#172554
classDef toneAmber fill:#fef3c7,stroke:#d97706,stroke-width:1.5px,color:#78350f
classDef toneMint fill:#dcfce7,stroke:#16a34a,stroke-width:1.5px,color:#14532d
classDef toneRose fill:#ffe4e6,stroke:#e11d48,stroke-width:1.5px,color:#881337
classDef toneIndigo fill:#e0e7ff,stroke:#4f46e5,stroke-width:1.5px,color:#312e81
classDef toneTeal fill:#ccfbf1,stroke:#0f766e,stroke-width:1.5px,color:#134e4a
class node_app,node_upload_page,node_upload_box,node_api_client,node_results_page,node_dashboard_page,node_graph_page,node_report_page toneBlue
class node_backend_api,node_applications toneAmber
class node_sbom_parser,node_report_service,node_vulnerability_check,node_license_check,node_maintenance_check,node_risk_score,node_dependency_graph,node_vulnerability_db,node_license_rules toneMint
class node_correlation_service toneRose
class node_user toneIndigo
```

## Components

### Frontend

- [Application Router](https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/App.jsx): `frontend/src/App.jsx`
- [Upload Page](https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Upload.jsx): `frontend/src/pages/Upload.jsx`
- [SBOM Upload](https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/components/UploadBox.jsx): `frontend/src/components/UploadBox.jsx`
- [API Client](https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/api/api.js): `frontend/src/api/api.js`
- [Analysis Results](https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Results.jsx): `frontend/src/pages/Results.jsx`
- [Dashboard](https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Dashboard.jsx): `frontend/src/pages/Dashboard.jsx`
- [Graph View](https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Graph.jsx): `frontend/src/pages/Graph.jsx`
- [Executive Report](https://github.com/gururaj-s-cse/sbom/blob/main/frontend/src/pages/Report.jsx): `frontend/src/pages/Report.jsx`

### Backend API

- [Flask API](https://github.com/gururaj-s-cse/sbom/blob/main/backend/app.py): `backend/app.py`
- [Application Registry](https://github.com/gururaj-s-cse/sbom/blob/main/backend/sample_data/applications.json): `backend/sample_data/applications.json`

### SBOM Analysis

- [SBOM Parser](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/parser.py): `backend/services/parser.py`
- [Report Orchestrator](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/report_service.py): `backend/services/report_service.py`
- [Vulnerability Scan](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/vulnerability_service.py): `backend/services/vulnerability_service.py`
- [License Audit](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/license_checker.py): `backend/services/license_checker.py`
- [Maintenance Check](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/maintenance_checker.py): `backend/services/maintenance_checker.py`
- [Risk Scoring](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/risk_score.py): `backend/services/risk_score.py`
- [Dependency Graph](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/dependency_graph.py): `backend/services/dependency_graph.py`
- [Vulnerability Data](https://github.com/gururaj-s-cse/sbom/blob/main/backend/sample_data/vulnerability_db.json): `backend/sample_data/vulnerability_db.json`
- [License Rules](https://github.com/gururaj-s-cse/sbom/blob/main/backend/sample_data/license_rules.json): `backend/sample_data/license_rules.json`

### Cross-System Analysis

- [Application Correlation](https://github.com/gururaj-s-cse/sbom/blob/main/backend/services/correlation_service.py): `backend/services/correlation_service.py`

### Other components

- **Security Analyst**

## Connections

- Security Analyst → Application Router: uses (evidence: `frontend/src/App.jsx`)
- Application Router → Upload Page: routes to (evidence: `frontend/src/App.jsx`)
- Application Router → Analysis Results: routes to (evidence: `frontend/src/App.jsx`)
- Application Router → Dashboard: routes to (evidence: `frontend/src/App.jsx`)
- Application Router → Graph View: routes to (evidence: `frontend/src/App.jsx`)
- Application Router → Executive Report: routes to (evidence: `frontend/src/App.jsx`)
- Upload Page → SBOM Upload: renders (evidence: `frontend/src/pages/Upload.jsx`)
- SBOM Upload → API Client: uses (evidence: `frontend/src/components/UploadBox.jsx`)
- API Client → Flask API: requests
- Flask API → Application Registry: loads (evidence: `backend/app.py`)
- Flask API → SBOM Parser: parses upload (evidence: `backend/app.py`)
- Flask API → Report Orchestrator: generates report (evidence: `backend/app.py`)
- Flask API → Dependency Graph: builds graph (evidence: `backend/app.py`)
- Flask API → Vulnerability Scan: checks vulnerabilities (evidence: `backend/app.py`)
- Flask API → License Audit: checks licenses (evidence: `backend/app.py`)
- Flask API → Application Correlation: gets correlations (evidence: `backend/app.py`)
- Report Orchestrator → SBOM Parser: parses SBOM (evidence: `backend/services/report_service.py`)
- Report Orchestrator → License Audit: checks licenses (evidence: `backend/services/report_service.py`)
- Report Orchestrator → Vulnerability Scan: checks vulnerabilities (evidence: `backend/services/report_service.py`)
- Report Orchestrator → Maintenance Check: checks maintenance (evidence: `backend/services/report_service.py`)
- Report Orchestrator → Risk Scoring: calculates score (evidence: `backend/services/report_service.py`)
- Report Orchestrator → Dependency Graph: builds attack paths (evidence: `backend/services/report_service.py`)
- Vulnerability Scan → Vulnerability Data: reads (evidence: `backend/services/vulnerability_service.py`)
- License Audit → License Rules: reads (evidence: `backend/services/license_checker.py`)
- Application Correlation → SBOM Parser: parses app SBOMs (evidence: `backend/services/correlation_service.py`)
- Application Correlation → Vulnerability Scan: checks vulnerabilities (evidence: `backend/services/correlation_service.py`)
- Application Correlation → License Audit: checks licenses (evidence: `backend/services/correlation_service.py`)
- Application Correlation → Maintenance Check: checks maintenance (evidence: `backend/services/correlation_service.py`)
- Analysis Results → Flask API: displays analysis
- Graph View → Dependency Graph: displays graph
- Executive Report → Report Orchestrator: displays report