Upload Scanning: Software Bills of Materials (SBOMs), CSAF/Vulnerability Exploitability eXchange (VEX), Manifests and Database Change-Logs

BeginnerFree5 modules · 15 lessons · ~2 min

About this course

A guide to Safeguard's five upload paths, App Binary, Manifest File, SBOMs, CSAF/VEX and the Database Change-log Scanner, and when handing over a file beats waiting on a live connector. You will learn when an upload is the only option (air-gapped networks, vendor deliverables, third-party artefacts), how to read SPDX and CycloneDX documents before you trust them, the difference between a Source SBOM and a Build SBOM, how CSAF and VEX statements suppress noise correctly without hiding real risk, the limits of manifest-only scanning, and how to review database migrations for security impact before they run.

What you'll learn

Why and When to Upload

When an Upload Beats a Connector: Air-Gapped, Third-Party and Vendor Deliverables
The Five Upload Types: Binaries, Manifests, SBOMs, CSAF/VEX and Database Change-Logs
Getting the First Upload Right: Format, Size and What Happens After You Click Upload

SBOM Formats and Types

Reading SPDX for an Upload: What You Are Handing the Scanner
Reading CycloneDX for an Upload: What You Are Handing the Scanner
Source SBOM versus Build SBOM: Which One You Actually Have
Choosing SPDX or CycloneDX When You Control the Generator

Uploading Binaries and Manifests

Upload App Binary: What Gets Extracted From a Compiled Artifact
Upload Manifest File: package.json, requirements.txt and Friends
Manifest-Only Scanning and Its Limits: What a Manifest Cannot Tell the Scanner

01Why and When to Upload3 lessons

When an Upload Beats a Connector: Air-Gapped, Third-Party and Vendor Deliverables
The Five Upload Types: Binaries, Manifests, SBOMs, CSAF/VEX and Database Change-Logs
Getting the First Upload Right: Format, Size and What Happens After You Click Upload

02SBOM Formats and Types4 lessons

Common questions

How much does Safeguard Academy cost?

Nothing. Every course, exam, and certificate on the catalog is free — including retakes. All you need is a free Safeguard account.

What are the prerequisites?

None. The flagship course, Safeguard Certified Practitioner, is a beginner-level course — basic familiarity with how software is built helps, but every exam question is answerable from the lessons themselves.

What CSAF and VEX Actually Are and Why They Exist Together
Reading a VEX Statement: Status, Justification and Which Findings It Suppresses
Uploading CSAF/VEX Correctly: Matching Statements to Components Without Losing Real Findings

Database Change-Logs and Operating Uploads Over Time

The Database Change-Log Scanner: Reviewing Migrations for Security Impact
Operating an Upload Program: Versioning, Re-Uploading and Keeping Uploads From Going Stale

Reading SPDX for an Upload: What You Are Handing the Scanner

Reading CycloneDX for an Upload: What You Are Handing the Scanner

Source SBOM versus Build SBOM: Which One You Actually Have

Choosing SPDX or CycloneDX When You Control the Generator

03Uploading Binaries and Manifests3 lessons

Upload App Binary: What Gets Extracted From a Compiled Artifact
Upload Manifest File: package.json, requirements.txt and Friends
Manifest-Only Scanning and Its Limits: What a Manifest Cannot Tell the Scanner

04CSAF and VEX3 lessons

What CSAF and VEX Actually Are and Why They Exist Together
Reading a VEX Statement: Status, Justification and Which Findings It Suppresses
Uploading CSAF/VEX Correctly: Matching Statements to Components Without Losing Real Findings

05Database Change-Logs and Operating Uploads Over Time2 lessons

The Database Change-Log Scanner: Reviewing Migrations for Security Impact
Operating an Upload Program: Versioning, Re-Uploading and Keeping Uploads From Going Stale2 min

What happens if I fail the exam?

You can retake it after a 24-hour cooldown, as many times as you need. Retakes are free, and each attempt draws a fresh random set of questions.

How long is a certificate valid?

The Safeguard Certified Practitioner credential is valid for 24 months from issue. The expiry date is printed on the certificate and shown live on its public verification page. Renewing means passing the current exam again.