FOSSA
lastmod 2026-11-10created 2025-01-282 edits
FOSSA is a commercial service that automatically scans the open-source dependencies used by software to manage license compliance and security vulnerabilities. It integrates a CLI into the build process to collect the dependency list, reports license policy violations, and generates an SBOM (software bill of materials). Organizations that need open-source governance and supply chain security use it as an alternative to tools such as Black Duck and Snyk.