Harbor Artificial Contact
Menu Close

Code & AppSec · S-CODE-2

Dependency Risk & SBOM

Know every dependency you ship, and which ones bite.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Compare 3 tiers Book a call

Pricing

Compare tiers

Pay the deposit to start. Pay the final balance before handoff.

Starter

$650

Hours. 5 hours

Scope. 1 repo, 1 package ecosystem

Deliverables

  • SBOM (1 format), vulnerable-dependency table, upgrade order

Turnaround. 3 business days

Pay deposit ($325) (opens Stripe in a new tab) Pay final balance ($325) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Standard

$1,200

Hours. 9 hours

Scope. ≤3 repos, ≤3 ecosystems, ≤1 container image

Deliverables

  • SBOMs (both formats), license inventory, reachability notes for Critical/High

Turnaround. 5 business days

Pay deposit ($600) (opens Stripe in a new tab) Pay final balance ($600) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Advanced

$2,200

Hours. 17 hours

Scope. ≤8 repos, ≤4 container images

Deliverables

  • All Standard items
  • exploitability statements (VEX-style notes)
  • CI policy proposal

Turnaround. 8 business days

Pay deposit ($1,100) (opens Stripe in a new tab) Pay final balance ($1,100) (opens Stripe in a new tab)

Balance is due before handoff.

Terms cover this engagement. A statement of work controls the scope.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Retest included: Starter, one retest of Critical and High findings within 30 days; Standard, one retest of all findings within 45 days; Advanced, two retests within 60 days. Another round is the Extra Retest add-on.

Scope

Deliverables, limits, and standards

Standards mapping

CycloneDX 1.7 (ECMA-424) or SPDX 3.0 / 2.3; OWASP Top 10:2025 A03 Software Supply Chain Failures; NIST SSDF PS.3 / PW.4; NIST CSF 2.0 GV.SC / ID.AM.

Exclusions

  • Legal opinion on licenses
  • runtime/production scanning
  • private registries Harbor cannot access read-only

Acceptance

SBOM validates against the chosen spec schema; every Critical/High dependency has a fixed version or a documented no-fix rationale.

Scope. Not a penetration test, audit, or certification; no guarantee of breach prevention; written authorization required before any active testing.

Book a call All security services

More in Code & AppSec

Not sure this tier is the one?

Email [email protected] with the system you want reviewed. We will point at a tier in this catalog, or tell you if the work is outside it.

Book a call All security services