Home | AboutCode.org

With open data, open code, and open standards.
Modern software is assembled from thousands of open source components. For each one you need to know where it comes from, what license applies, whether it has known vulnerabilities, and if it is actively maintained.
AboutCode provides open tools, open data, and open standards to answer these questions and keep your software supply chains safe and compliant.
Reusable building blocks like ScanCode, so you can focus on your processes, policies, and automation.
Automated processes require consistency, with standards like Package-URL (PURL) and VERS.
Data you can trust to make your processes more efficient, like PurlDB and VulnerableCode.
We work together on shared ecosystem solutions for shared ecosystem challenges.
AboutCode provides modular building blocks for software composition analysis, from license detection to vulnerability management, that you can combine to match your workflow.
Detect licenses in any codebase, whether open source, or proprietary; in source code and binaries. Powers dozens of open source and commercial SCA tools.
Identify code origin at package, file, and snippet level using PurlDB fingerprints and matching pipelines.
Match deployed binaries, containers, and firmware back to source packages. Analyze ELFs, PEs, Mach-Os, and archives.
Resolve direct and transitive dependencies across package ecosystems with ScanCode pipelines and dedicated inspectors.
Aggregate vulnerability data, map to affected packages, identify fixes, and score exploitability and risk for triage.
Generate and manage SBOMs in CycloneDX and SPDX. Meet CRA requirements with automated VEX reporting and vulnerability tracking.
AboutCode is supported by over 700 contributors and downloaded over 4 million times per day. Join our chat and our weekly calls to meet and start the conversation with AboutCode maintainers and contributors.
Our open tools, data, and standards are used by leading open source projects and organizations worldwide.
AboutCode created Package-URL (PURL), the universal identifier for software packages now used across CycloneDX, SPDX, CSAF, OpenVEX, OSV, MITRE CVE, and many more standards. AboutCode also created VERS for version ranges and contributes to CycloneDX and co-founded SPDX.
PURL is the common thread that ties SBOMs, vulnerability databases, security advisories, and attestations together.
SPDX license expressions enable common, concise and accurate licensing identification across tools and SBOMs.
Curated datasets for thousands of licenses, millions of packages, and aggregated vulnerability data from dozens of public sources. We believe software supply chain data should be open, decentralized, and federated. Our FederatedCode approach enables anyone to publish and consume package, license, and vulnerability data using open protocols without a single point of control, and no vendor lock-in. All AboutCode data is freely available under open licenses via public APIs.
PurlDB is a comprehensive, open database of software package metadata indexed by Package-URL. Combined with ClearlyDefined - managed by AboutCode - it provides provenance, licensing, and origin data for millions of packages.
ScanCode LicenseDB is the largest open database of software licenses, with over 2,500+ curated license texts, over 35,000 detection rules, and SPDX mappings used by scanners worldwide.
VulnerableCode is a free and open database of software package vulnerabilities, correlating advisories from 30+ sources and mapping them to affected packages using Package-URL.
AboutCode has been designed as a modular stack of applications, tools, libraries and data. We maintain, support and contribute to key open source projects that support healthy software supply chains. Some of these key projects are listed below.
All of the software is open source (primarily licensed under Apache-2.0) and all of the data is open (primarily licensed under CC-BY-SA-4.0).
ScanCode.io provides a Web UI and API to run and review complex scans in rich scripted pipelines, on different kinds of containers, docker images, package archives, manifests etc, to get information on licenses, copyrights, sources, and vulnerabilities.
ScanCode Toolkit is a set of code scanning tools that detect the origin (copyrights), license and vulnerabilities of code, packages and dependencies in a codebase.
PURLDB provides tools to create and update a database of package metadata keyed by PURL (Package URL) and an API for the PURL data.
DejaCode provides an enterprise-level application to automate open source license compliance and ensure software supply chain integrity, powered by ScanCode.
VulnerableCode provides a Web UI and API to access a database of known software package vulnerabilities with comprehensive information from upstream and downstream public sources including packages affected by a vulnerability and packages that fix a vulnerability. There is a public VulnerableCode database at: https://public.vulnerablecode.io/ and the project also provides the tools to build your own instance of the database.
Package-URL (PURL) is a specification to reliably identify and locate software packages across package ecosystems.
ClearlyDefined curates and serves open source component metadata for license, copyright, source, and security compliance.
AboutCode tools support a large number of licenses, package ecosystems, programming languages, and vulnerability data sources, all identified using Package-URL (PURL) or SPDX license expressions. See a few highlights below; the full set of supported Environments also includes operating systems, programming languages, binary and archive formats, and more data sources.
AboutCode tracks over 2,500+ curated licenses across 12 categories. Browse all 2,500+ licenses in the LicenseDB. Industry-leading license detection is backed by over 35,000 license notices used as detection rules. See more supported licenses.
AboutCode collects, correlates, and improves vulnerabilities from