> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cryptarium.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# CBOM (CycloneDX)

> Emit a CycloneDX Cryptography Bill of Materials using cryptographic-asset components.

# CBOM (CycloneDX)

**Purpose:** Machine-readable cryptographic inventory using CycloneDX **1.6+** `cryptographic-asset` components.

**When to use:** Feed enterprise posture platforms, Dependency-Track-style tools, or any CycloneDX-aware pipeline. This is the portable inventory artifact.

## Example

```bash theme={null}
cryptarium scan . --format cbom --output cbom.json
```

## Caveats

* Private keys and secrets are extracted for **metadata only** and discarded. Snippets are redacted before output.
* The CBOM must remain identical if optional AI enrichment is toggled on or off (enrichment annotates; it never reclassifies).
* Static discovery is incomplete by nature — the CBOM is an inventory of what was found, not a completeness certificate.

## Related

* [Determinism](/concepts/determinism)
* [SARIF](/outputs/sarif)