FOSSA offers an automated platform that scans all open‑source dependencies in a codebase—including packages, containers, binaries, and code snippets—to identify licenses, vulnerabilities, and quality issues. It integrates with CI/CD pipelines and version‑control systems to continuously generate up‑to‑date SBOMs, enforce compliance policies, and provide guided remediation, helping engineering and security teams maintain compliance and reduce risk.
Funding
$5.1M raised to dateRaised to date based on public sources. This may differ from the amount the company actually raised and is based only on what is publicly available on the internet.
Founders
Product
Problem
Software development teams struggle to maintain visibility into the open‑source components they use, leading to hidden license violations, unpatched security vulnerabilities, and compliance gaps across packages, containers, binaries, and code snippets.
Solution
FOSSA provides an automated platform that scans every dependency in a codebase—across all languages, package managers, containers, binaries, and even extracted code snippets—to identify licenses, known vulnerabilities, and quality issues. The service integrates into CI/CD pipelines and version‑control systems, continuously generating up‑to‑date Software Bills of Materials (SBOMs) and compliance reports. Policy engines enforce licensing and security rules, while guided remediation suggests fixes for critical findings. Results are delivered through a web dashboard, API, and export formats (CycloneDX, SPDX), enabling teams to stay compliant, reduce risk, and ship faster without manual tracking.
Target Audience
Primary customers are engineering and security teams at enterprises and growing technology companies that need to manage open‑source risk, compliance, and supply‑chain security across large, multi‑language codebases.
Features
- Full‑stack scanning of packages, containers, binaries, and code snippets at unlimited depth
- Automatic generation and continuous updating of SBOMs with export to CycloneDX, SPDX, and hosted sharing
- License compliance engine with policy enforcement and attribution notice creation
- Vulnerability detection with real‑time alerts and guided remediation steps
- CI/CD and GitHub/GitLab integrations for seamless, automated scans on each commit
- API and enterprise‑grade SDKs for custom workflows and third‑party tool integration
- Role‑based access control, SSO, and enterprise‑grade SLAs for secure multi‑team usage
- Optional add‑ons for AI‑generated snippet detection and deep binary component analysis