SBOM build for VibeControls
Syft CycloneDX SBOM + Grype scan at build lifecycle stage.
vibe plugin install @vibecontrols/vibe-plugin-security-sbom-build
About this plugin
Generates a CycloneDX SBOM via Syft and scans it for known vulnerabilities via Grype. Targets the build lifecycle stage in VibeControls.
Registers as a security.sbom provider (name syft-grype) with the @vibecontrols/vibe-plugin-security meta plugin.
Install
vibe plugin install @vibecontrols/vibe-plugin-security-sbom-build
vibe security providers set-default --stage build --provider syft-grype
Both Syft (Anchore) and Grype (Anchore) binaries are downloaded automatically on first use with sha256 verification.
Outputs
sbom.cdx.json— CycloneDX 1.5 SBOM (evidence typesbom-cyclonedx)grype.json— Grype vulnerability report (evidence typegrype-json)NormalizedFinding[]— one row permatches[]entry with CVE, package, fix version, severity
Use it in 30 seconds
- Make sure the agent is running:
vibe start - Install the meta first:
vibe plugin install @vibecontrols/vibe-plugin-security - Install this plugin:
vibe plugin install @vibecontrols/vibe-plugin-security-sbom-build - List installed plugins:
vibe plugin list
Other Security plugins
Archive Offboard
Writes tombstone.json evidence at archive.offboard for SOC2/ISO retention proofs.
@vibecontrols/vibe-plugin-security-archiveDAST (preview)
OWASP ZAP baseline DAST scan against alpha preview URLs at deploy.preview.
@vibecontrols/vibe-plugin-security-dast-previewDeploy alpha smoke
TLS / HSTS / CSP smoke checks for alpha environment URLs at deploy.alpha.
@vibecontrols/vibe-plugin-security-deploy-alphaDeveloper local
Local pre-commit secrets scanner (gitleaks protect) — runs on the developer machine.
@vibecontrols/vibe-plugin-security-developer-localIncident response
Targeted incident-response scanner for incident.response lifecycle stage.
@vibecontrols/vibe-plugin-security-incidentRepo onboard
Repo profile detector — picks the right policy bundle on repo.onboard.
@vibecontrols/vibe-plugin-security-onboard