Reducing SBOM Complexity with Open-Source Low-Code

Introduction

As enterprises continue their digital transformation journeys, the complexity of managing software supply chains has increased dramatically. Software Bills of Materials (SBOMs) have become critical tools for transparency and security, but their management presents significant challenges. This report explores how open-source low-code platforms and AI application generators can potentially simplify SBOM management while maintaining robust security practices.

Understanding Software Bill of Materials (SBOM)

A Software Bill of Materials (SBOM) is a comprehensive inventory that details all software components used in an application, including source code, libraries, packages, and modules, along with their corresponding version numbers, licenses, and other relevant metadata. The purpose of an SBOM is to ensure transparency and traceability within the software supply chain, allowing organizations to identify and address potential security vulnerabilities and compliance risks.

Modern applications are complex assemblies of third-party software and proprietary code, with as much as 80% of code coming from third-party sources. This complexity makes SBOMs essential for maintaining visibility into the development environment, especially as software supply chains become an expanding attack surface.

SBOMs have gained significant importance following high-profile supply chain attacks like SolarWinds, prompting the US government to mandate their use as an industry-standard solution. Organizations that effectively implement SBOM practices can better manage vulnerabilities, improve compliance, and strengthen their overall supply chain security posture.

Regulatory Requirements and Importance

As of 2025, SBOM generation has become a core development step that teams must complete to build and ship software safely. Regulations across multiple sectors and geographies increasingly require detailed software inventories or SBOMs. These regulatory requirements reflect growing concerns about software supply chain security and the need for greater transparency in software composition.

Challenges in SBOM Management

Creating an SBOM is only the first step in maintaining software security. Organizations face several challenges in managing SBOMs effectively, particularly for large software portfolios:

Complexity of Modern Software Supply Chains

Modern software development involves numerous dependencies, making it difficult to track all components used in applications. As noted by the National Security Agency (NSA), organizations need a comprehensive approach to SBOM management that encompasses integration with other systems, supporting access to data sources, and maintaining a scalable architecture.

Accuracy and Maintenance Challenges

Identifying all software components and keeping track of updates and patches requires a systematic approach. SBOM management involves generating, storing, analyzing, and monitoring SBOM documentation throughout the application lifecycle. An SBOM has little value when “left dormant within the build directory where it was generated”.

Open-Source Low-Code Platforms as a Solution

Low-code platforms offer a potential solution to simplify SBOM management by reducing the amount of custom code that needs to be tracked and secured.

Leading Open-Source Low-Code Platforms

The open-source low-code ecosystem has matured significantly by 2025, offering several robust options:

1. Appsmith: A platform with 35.2k GitHub stars that enables rapid development of internal applications through drag-and-drop widgets and inline JavaScript customization. It supports integration with diverse databases and APIs and provides 256-bit encryption for security.

2. Budibase: Considered the best open-source, low-code app builder, Budibase allows businesses to create applications by merging databases, spreadsheets, and APIs, with on-premise hosting options using Docker and Kubernetes.

3. ToolJet: With 33.7k GitHub stars, ToolJet provides a drag-and-drop interface for building custom internal tools with JavaScript and Python support. It allows developers to reuse React components easily and offers security, scalability, and multi-environment support.

4. Saltcorn: A fast, free, open-source low-code solution enabling users to create web and mobile applications with a drag-and-drop builder.

5. Additional Options: Other notable platforms include Frappe, Corteza, ILLA, Noodl, and Lowcoder.

SBOM Benefits of Low-Code Development

Open-source low-code platforms can simplify SBOM management in several ways:

1. Standardized Components: Low-code platforms typically use standardized libraries and components, reducing the variety of dependencies that need to be tracked.

2. Transparent Supply Chain: Since these platforms are open-source, their components are more transparent and can be more easily included in an SBOM.

3. Reduced Custom Code: By enabling rapid development with less custom code, low-code platforms can potentially reduce the overall complexity of an application’s dependency tree.

AI Application Generators and Their Impact on SBOMs

AI-driven code generation offers another approach to simplifying SBOM management while accelerating development.

Automated Project Setup and Dependency Management

AI code generators can automate project setup, configuration management, and dependency installation, potentially creating more standardized and secure applications. They can:

1. Automate Project Setup: Generate full project scaffolds with pre-configured directory structures for frameworks like React, Next.js, Django, and Express.js.

2. Manage Configurations: Create configuration files like .gitignore, .env templates, and linting rules automatically.

3. Handle Dependencies: Install dependencies automatically based on project type, resolve version conflicts, and detect security vulnerabilities in libraries.

Benefits for SBOM Management

AI-driven code generation and optimization offer several benefits for SBOM management:

1. Pattern Recognition: The ability to automatically identify patterns, dependencies, and best practices in code can significantly improve the quality and efficiency of generated code.

2. Standardization: AI models can analyze large codebases and learn from existing examples to generate code that adheres to industry standards and best practices, ensuring generated code is of high quality.

3. Optimization: Machine learning can optimize code for specific hardware architectures or performance constraints, leading to better overall system performance and resource utilization.

4. Dependency Reduction: AI can potentially help identify and eliminate unnecessary dependencies, reducing the SBOM complexity.

Security Considerations for Citizen Development

While low-code platforms democratize development, they also introduce potential security risks that must be addressed to maintain SBOM integrity.

Risks of Citizen Development

The rise of “citizen developers” – business users creating applications without traditional programming skills – introduces several privacy and security risks:

1. Compliance Issues: Citizen developers may not be aware of regulations like GDPR, HIPAA, and CCPA that require protection of personal data.

2. Data Leakage: Non-technical developers may inadvertently expose sensitive data through misconfigured access controls or by sharing data with unauthorized users.

3. Security Vulnerabilities: Citizen-developed applications may lack proper security measures, making them susceptible to common vulnerabilities like SQL injection, cross-site scripting, and cross-site request forgery.

4. Third-Party Component Risks: Low-code platforms often rely on third-party components whose lineage and security posture are unclear, emphasizing the need for a robust SBOM to understand dependencies.

Mitigation Strategies

Organizations can address these risks while still benefiting from low-code development:

1. Training and Awareness: Require training programs to educate citizen developers about privacy and security best practices.

2. Secure By Design: Involve security professionals to provide guidance and design security into low-code applications from the start.

3. Access Controls: Implement robust access controls and permissions commensurate with data sensitivity and regularly review them.

4. Integration with IAM: Integrate low-code platforms with Identity and Access Management systems, such as implementing Single Sign-On with Active Directory.

5. Centralized Governance: Establish a governance framework to centralize control over citizen-developed applications, including approval processes, version control, and compliance checks.

SBOM Management Best Practices in Low-Code Environments

Implementing effective SBOM management in low-code environments requires a structured approach:

1. Generate SBOMs for All Applications

Organizations should generate an SBOM for every application during the build process. This creates an audit trail that helps identify which components are in specific versions of applications, useful when new vulnerabilities are discovered in older components.

Automating the SBOM creation process ensures every build has a corresponding SBOM for compliance purposes. This is particularly important for low-code applications, where the underlying components may change with platform updates.

2. Properly Store and Manage SBOMs

SBOMs should be stored in a centralized repository like Sonatype SBOM Manager, rather than leaving them in build directories. This provides centralized storage for both internally developed and third-party applications.

Organizations should be cautious about sharing SBOMs publicly, as application composition can contain sensitive information. SBOMs can be run through Software Composition Analysis tools to create a list of vulnerabilities in applications.

3. Integrate with Security and Compliance Tools

By analyzing SBOM data across the organization, teams can identify trends such as repeated use of outdated or end-of-life components. This analysis can drive a smarter Software Composition Analysis (SCA) strategy.

While SCA tools are optimized for active development environments and run against build-time artifacts, SBOMs take software transparency further by allowing organizations to track the evolving security posture of software long after release into production.

4. Address the Full Component Scope

When creating SBOMs for low-code applications, organizations should consider multiple layers of components:

1. Language-level dependencies

2. Dependencies of language dependencies

3. System dependencies

4. The operating system

5. External cloud services

6. Compilers

The FDA guidance suggests including “upstream software dependencies that are required/depended upon by proprietary, purchased/licensed, and open-source software,” which typically means the first four categories.

5. Automate SBOM Generation

Several tools are available to automate SBOM generation, which is especially useful for low-code environments:

1. Commercial options: FOSSA offers a paid version with a free tier that is often sufficient for first submissions and includes vulnerability monitoring.

2. Platform-specific tools: GitHub supports generating SBOMs automatically, and Amazon Inspect can produce SBOMs from EC2 and Lambda instances.

3. Container-specific tools: Syft or Docker Scout can generate SBOMs from container images or filesystems.

4. Integration tools: The Zenity SBOM solution seamlessly integrates with all Low-Code/No-Code development platforms, performing automatic scans of applications and generating comprehensive inventories of all components.

The Role of AI in SBOM Generation and Management

AI can significantly enhance SBOM generation and management, particularly for low-code applications:

Automated Dependency Analysis

AI systems can analyze application code to automatically identify dependencies and generate comprehensive SBOMs, potentially with greater accuracy than manual methods. This is particularly valuable for low-code platforms, where dependencies may not be as explicit as in traditional development.

Vulnerability Prediction

Beyond simply identifying known vulnerabilities in dependencies, AI can potentially predict which components might be vulnerable in the future based on patterns and characteristics. This predictive capability could help organizations proactively manage risk.

Intelligent Component Selection

AI can recommend safer alternative components when potential security issues are detected, helping developers make more informed choices about the libraries and frameworks they incorporate.

Conclusion

The intersection of open-source low-code platforms, AI application generators, and SBOM management represents a promising approach to addressing the growing complexity of software supply chains in enterprise environments.

Key Takeaways

1. Strategic Value: SBOMs are no longer optional but essential components of software development, especially as regulatory requirements increase.

2. Simplification Through Low-Code: Open-source low-code platforms can reduce the complexity of software supply chains by standardizing components and reducing custom code.

3. AI Augmentation: AI-driven code generation and analysis can further enhance the efficiency and security of application development while potentially simplifying SBOM management.

4. Balanced Approach: Organizations must balance the benefits of citizen development with proper governance and security measures.

5. Automation First: Automating SBOM generation and management is critical, especially as software complexity increases.

As enterprises continue their digital transformation journeys, the strategic integration of open-source low-code platforms and AI application generators with robust SBOM practices will be essential for maintaining security, compliance, and transparency in software supply chains.

Organizations that successfully implement these approaches will be better positioned to address emerging threats, meet regulatory requirements, and deliver secure, high-quality software at the speed demanded by modern business.