# sbom

How to use JFrog Xray to scan Docker images, Maven JARs, and npm packages for CVEs and license violations — setting up security policies, watching repositories, and blocking builds with policy violations.

Add automated dependency vulnerability scanning to your CI pipeline using Trivy and Grype. Catch known CVEs before they hit production.

Sign and verify your container images with Sigstore Cosign to prevent supply chain attacks — with keyless signing, SBOM attestation, and Kubernetes admission enforcement.