DejaCode vs SBOM Workbench

DejaCode is an enterprise application for managing open-source license compliance and software supply-chain integrity across products and teams. It tracks open-source and third-party components, with unlimited products, components, and packages in each plan. Teams can store and manage SBOMs, retain historical records for audits, and import CycloneDX, SPDX, or AboutFile formats. Usage policies can be set at license or package level and linked with ScanCode; enforcement is advisory. Integrations include GitHub, GitLab, Jira Cloud, SourceHut, and Forgejo, with REST API and webhook options for other services. AboutCode connections include ScanCode.io for package scanning, PurlDB, and VulnerableCode for vulnerability data. Deployment documentation covers Docker, enterprise, and local development setups. For enterprise deployments, the guidance recommends running your own related service instances to avoid sending sensitive or private data to public endpoints. Team starts at $500 a month and Business at $1,500 a month, each billed annually at the start of the subscription period. Enterprise pricing is custom and not listed. A private evaluation instance with all features and support is available for 30 days.

SBOM Workbench is a graphical tool for scanning and auditing source code through the SCANOSS API. It identifies open-source components, including undeclared code that may not appear in dependency manifests, and the free version identifies licenses and security vulnerabilities. It generates SPDX-Lite software bills of materials; release notes also list CycloneDX, SPDX Lite, CSV, and HTML exports. The tool is aimed at developers and runs on Linux, macOS, and Windows. Its CLI can use multiple SCANOSS API endpoints, including custom servers. Listed integrations include pre-commit hooks, Actions, pipelines, and webhooks, while Bitbucket is marked as coming soon. Repository documentation describes a collaborative workspace. The distributed software is described by SCANOSS as open source, and the Workbench has a public GitHub repository. Cryptographic algorithm identification is a premium feature, not included in the free Workbench. It is free to download, and SCANOSS directs support requests to email. Paid SCANOSS subscription prices listed for other offerings are not Workbench prices.