> For the complete documentation index, see [llms.txt](https://docs.opsmx.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.opsmx.com/code-to-cloud-security-and-scanners/artifact-security/source-scan-artifacts.md).

# Source Scan Artifacts

The **Source Scan Artifacts** page gives you a centralized view to monitor and manage the security posture of all source scan artifacts. From here, you can assess risks, review detailed scan reports, and take timely action to remediate vulnerabilities. 

* Navigate to **Security Issues** -> **Source Scan Artifacts**. 
* The panel at the top displays the total number of artifacts in the application, and the risk status of the artifacts.
  * **Critical Risk** - The artifacts that are of critical risk. 
  * **High Risk** - The artifacts that are of high risk. 
  * **Medium Risk** - The artifacts that are of medium risk. 
  * **Low Risk** - The artifacts that are of low risk.

<figure><img src="/files/IbtxOu6vTd9Tt7ImVE5v" alt=""><figcaption></figcaption></figure>

The panel below displays the various details of the artifacts.

<figure><img src="/files/mupX5KnbeYiQUEKyPmHW" alt=""><figcaption></figcaption></figure>

* **Artifact:** The name or identifier of the specific artifact being scanned.
* **Artifact Version:** The version number or tag of the artifact (e.g., commit hash, build tag).
* **Semantic Tags:** Labels applied to an artifact that follow versioning conventions (e.g., v1.2.3) or convey its current state (e.g., latest, stable).
* **Artifact SHA:** A unique cryptographic hash (such as SHA-256) used to identify and verify the exact contents and integrity of the artifact.
* **Stage:** The current lifecycle stage of the artifact (e.g., Generated / Not Deployed).
* **Source Repository:** The origin version control system repository (e.g., GitHub, GitLab) where the code used to build the artifact is stored.
* **Branch:** The specific version control branch (e.g., main, develop) from which the artifact's source code was compiled or built.
* **DBOM Status:** The current state or availability of the Deployment Bill of Materials, which tracks the dependencies and components associated with deploying the artifact.
* **Open Issues:** The count and severity of active security issues or vulnerabilities found in the artifact.
* **Vulnerability:** The risk level or vulnerability status associated with the scan results.
* **Created On:** The timestamp or date when the artifact or scan report was generated.
* **Team:** The group or team responsible for managing or owning the artifact.
* **Built by:** Information regarding who or what pipeline built the artifact.
* **Actions** - On clicking the three dots, you can view the list of scans run on the artifact as shown below:

<figure><img src="/files/KeDtQuxaAWhxaH8pZYYu" alt=""><figcaption></figcaption></figure>

You can download the scan results by clicking on it.&#x20;

### Viewing SBOM for Artifacts

The SBOM for listed artifacts can be viewed by clicking the **View SBOM** option as shown below:&#x20;

<figure><img src="/files/PnVzEXZWfYL5uEnMObuU" alt=""><figcaption></figcaption></figure>

On clicking **View SBOM**, the SBOM page is displayed.&#x20;

<figure><img src="/files/Iy6cjtq4Axsc3JmjIc8F" alt=""><figcaption></figcaption></figure>

It displays the various components and related details of the components as shown below:

* **Component** - Displays the associated components of the artifacts.
* **Version** - Displays the version details of the component.&#x20;
* **Package URL** - Displays the package URL of the component.
* **License** - Displays the list of licenses that are available for the component.&#x20;
* **Vulnerabilities** - Displays the count of vulnerabilities related to the component.&#x20;
* **Reports** - The OSS Risk report is displayed. On clicking it, the associated OSS risk page for the artifact is displayed.&#x20;
* **Actions -** On clicking **Edit License**, you can edit the license type.

{% hint style="info" %}

* You can view the vulnerabilities of the components by clicking the **Vulnerabilities** column.&#x20;
* You can download the SBOM details in .json or .csv format by clicking the **SBOM File** button.&#x20;
* You can download the SBOM details in report format (.pdf or .html) by clicking the **SBOM** **Report** button.&#x20;
  {% endhint %}

### SBOM, CBOM, AIBOM and QBOM&#x20;

The SBOM, CBOM and QBOM for the artifacts can be accessed from the Reports column.&#x20;

<figure><img src="/files/Mi29eqFdKZwTThUVRP6n" alt=""><figcaption></figcaption></figure>

The icons are displayed in the Reports column.&#x20;

* **SBOM** - This **displays** the individual SBOM (Software Bill of Materials) details for the corresponding artifact.

<figure><img src="/files/9C6CXXuaB7TV3xaepYpi" alt=""><figcaption></figcaption></figure>

* **Compare** - This **displays** the SBOM (Software Bill of Materials) comparison page for the corresponding artifact.

<figure><img src="/files/QthURJLJxMYyqsIRQ3hM" alt=""><figcaption></figcaption></figure>

* **CBOM** - This **displays** the CBOM (Cryptography Bill of Materials) page for the corresponding artifact, showing its associated cryptographic components and details.

<figure><img src="/files/lfczBGLEN6Wy40eZgcvb" alt=""><figcaption></figcaption></figure>

* QBOM - Within the CBOM page, you can download the **QBOM (Quantum Bill of Materials)** for the corresponding artifact. QBOM provides visibility into an organization's cryptographic assets, flags quantum-vulnerable algorithms, tracks post-quantum cryptography adoption, and captures metadata required for CERT-In compliance.

<figure><img src="/files/EzibYq7AzvdcUSOmoOiQ" alt=""><figcaption></figcaption></figure>

* **AIBOM** - This displays the **AIBOM (AI Bill of Materials)** page for the corresponding artifact.

<figure><img src="/files/ArOFt71DcJ65JyuQjhZM" alt=""><figcaption></figcaption></figure>

* **OSS Risk** - This displays the OSS (Open Source Software) Risk page of the corresponding artifact.&#x20;

<figure><img src="/files/5noBXaBrF1jQ2bJEeSaQ" alt=""><figcaption></figcaption></figure>