docs/SBOM.md

Software Bill of Materials (SBOM)

The mona-agent client ships with an SBOM in CycloneDX format: sbom.cyclonedx.json.

Highlights

• 1 runtime dependency — ws (WebSocket implementation). No transitive runtime dependencies.
• Zero build step — the client runs directly from source on Node.js ≥ 20.
• Dev dependencies — none beyond the Node.js test runner.

Regeneration

cd apps/desktop
npm ls --json --omit=dev --all > /tmp/deps.json
# the sbom is regenerated from deps.json + package metadata (scripts/sbom.mjs)
node ../../scripts/sbom.mjs

Vulnerability handling

Dependencies are monitored on every change. If a CVE is reported in a dependency:

1. Triaged within 48 h
2. Fixed / mitigated and released
3. Coordinated disclosure via SECURITY.md

One dependency means the attack surface stays small — that is a deliberate engineering constraint of this project.