Lovable: Download an SBOM for Your Project
LovableLovable now lets users download a software bill of materials (SBOM) for a project from the dependency list in the Security view. The file comes in SPDX 2.3 or CycloneDX 1.5 format and lists production dependencies with their known vulnerabilities. Downloading an SBOM is free.
Key Takeaways
- SBOM export is now built into the Security view's dependency list, so no separate tooling is needed.
- Files are available in both SPDX 2.3 and CycloneDX 1.5, covering the formats most security tools ingest.
- The SBOM lists production dependencies and their known vulnerabilities, not just package names.
- It is aimed at security and procurement reviews, where vendors are often asked for a bill of materials.
- Downloading an SBOM is free and does not use credits.
- The feature makes supply-chain transparency a routine step for apps built with Lovable.
A Standard Dependency Inventory, Straight From the Security View
Lovable added the ability to download a software bill of materials (SBOM) for any project. The option lives in the dependency list inside the Security view, so it sits next to the vulnerability information builders already use to judge the health of an app.
Two Formats, Built for Sharing
The SBOM can be exported in SPDX 2.3 or CycloneDX 1.5, the two formats most widely accepted by security and procurement tooling. The file lists the project's production dependencies along with their known vulnerabilities. That makes it suitable for handing to a security reviewer or a procurement team, or for loading into an organization's own security tools.
Why It Matters
Teams that ship apps built with Lovable to customers or inside larger companies are increasingly asked for an SBOM during vendor reviews. Until now, producing one meant running separate tooling against exported code. With the download built into the Security view, a builder can answer that request in a couple of clicks. Lovable noted that downloading an SBOM is free, so it does not consume credits.