| # Software Bill of Materials (SBOM) | |
| The mona-agent client ships with an SBOM in CycloneDX format: | |
| [`sbom.cyclonedx.json`](../sbom.cyclonedx.json). | |
| ## Highlights | |
| - **1 runtime dependency** — `ws` (WebSocket implementation). No | |
| transitive runtime dependencies. | |
| - **Zero build step** — the client runs directly from source on | |
| Node.js ≥ 20. | |
| - **Dev dependencies** — none beyond the Node.js test runner. | |
| ## Regeneration | |
| ```bash | |
| cd apps/desktop | |
| npm ls --json --omit=dev --all > /tmp/deps.json | |
| # the sbom is regenerated from deps.json + package metadata (scripts/sbom.mjs) | |
| node ../../scripts/sbom.mjs | |
| ``` | |
| ## Vulnerability handling | |
| Dependencies are monitored on every change. If a CVE is reported in a | |
| dependency: | |
| 1. Triaged within 48 h | |
| 2. Fixed / mitigated and released | |
| 3. Coordinated disclosure via [SECURITY.md](../SECURITY.md) | |
| One dependency means the attack surface stays small — that is a | |
| deliberate engineering constraint of this project. | |