[prabhu]

Enrol projects/cdxgen

I have verified each of the following before submitting this project:

• I am a core maintainer of this project.
• I accept the OSS Scanner terms.
• I confirm that I believe my project meets the inclusion criteria and is an established project that users depend on.
• project.yaml follows the README (one project per PR; tools/validate.py passes locally).
• tools/check <name> builds the project, and its tests run in the shell that follows.
• primary_contact must be the email address of the primary security contact.
• There is a Dockerfile that builds the project (required) in one of two places: in the project's repository at the path dockerfile: names, or next to project.yaml in this repo.
• threat_model.md is written for this project (recommended but optional), placed in the same way: in the repository at the path threat_model: names, or next to project.yaml in this repo.

To change an enrolment, edit project.yaml; to pause reports, set disabled: true; to withdraw the project, remove projects/<name>/.

Context: cdxgen is an OWASP project that generates CycloneDX SBOMs and related documents. The npm package sees about 1.1 million downloads a month (@cyclonedx/cdxgen, now also published as @cdxgen/cdxgen), and it ships as container images and standalone binaries that run in CI pipelines and SBOM services. Most of what it does is parse untrusted input: manifests and lockfiles for more than 30 ecosystems, container images and archives, registry responses, and requests to its HTTP server. In the past year we published advisories for command injection, credential forwarding and signature forgery, which is the kind of bug this service looks for.

The Dockerfile and threat model live in our repository under .oss-scanner/, added in cdxgen/cdxgen#4478, which also lists cloud@appthreat.com in our SECURITY.md. tools/check builds the project in about two minutes, and the full test suite runs in the finished image.

[github-actions]

All contributors have signed the CLA ✍️ ✅
_{Posted by the CLA Assistant Lite bot.}

[prabhu]

I have read the CLA Document and I hereby sign the CLA

[github-actions]

Enrolment triage: projects/cdxgen

Repository: cdxgen/cdxgen · opened by prabhu

	Check	Result
✅	Repository	created 6 years ago, last push today
ℹ️	Stars / forks	1,085 stars · 263 forks
ℹ️	Criticality score	0.69 on the OpenSSF scale of 0 to 1 signals created_since 113, updated_since 0, contributor_count 144, org_count 6, commit_frequency 46.7, recent_releases_count 40, closed_issues_count 184, updated_issues_count 185, comment_frequency 0.7, dependents_count 751
✅	License	Apache-2.0
✅	Opened by an active maintainer	member of the owning organisation; 100+ commits in the last 12 months; #1 contributor
✅	Contact in SECURITY.md	cloud@appthreat.com is in SECURITY.md
ℹ️	OSS-Fuzz	not found in OSS-Fuzz
✅	.oss-scanner/ in the repository	present (Dockerfile, Dockerfile.dockerignore, threat_model.md); Dockerfile at .oss-scanner/Dockerfile
✅	Pull request scope	only this project's directory
✅	tools/validate.py	passes
✅	Checklist	all 8 ticked

_{Automated, from public GitHub data, to help reviewers. Enrolment is decided case by case against the criteria. If you think we got something wrong, please tell us in a reply.}