Product · DevSecOps Platform

Tamper-proofbuild evidence,on autopilot.

Security Compliance Management captures every software build, generates SBOM & Pipeline BOM, maps live vulnerabilities, detects security drift, and exports SEBI CSCRF-ready audit packs — turning manual compliance into a single command.

Book a demo Explore capabilities

security-compliance — capture · build #2841

$ scm capture --stack java --ci github

• Build identity locked · runner-7f3a · vishal@re

→ Resolving dependency tree (Maven)...

✓ 247 components · full transitive graph

✓ SHA-256 hashed every component + artifact

✓ Encryption libs: AES-256, RSA-2048

⚠ 3 known vulnerabilities mapped (OSV / GHSA)

→ Signing metadata with OIDC (GitHub)...

✓ Build attested & sealed · tamper-proof

$ scm export --sebi-cscrf

✓ Audit pack (.docx) · Annexure-X ✓

01 / Capture Agent

One CLI command. Every build, captured.

A single statically-linked Go binary intercepts your build commands, runner identity, and environment — zero dependencies, zero config drift. From signup to your first captured build in under five minutes.

Generated curl install script tailored to your stack & OS
Records Build Identity — Runner ID, timestamp, and user
Java (Maven / Ant) and Node.js pipeline support
Runs in GitHub Actions & Azure DevOps with < 5% overhead
Statically-linked — nothing to install, nothing to break

02 / SBOM & Drift

A complete SBOM — and the drift between builds.

PipeLock parses your full transitive dependency tree into a CSCRF-grade SBOM, maps every component against OSV and the GitHub Advisory database, then diffs against your previous release to surface new risk the moment it appears.

Supplier, component, version & PURL for every package
SHA-256 integrity hash on each component and the final artifact
Real-time CVE lookup across OSV & GitHub Advisory
Visual build-to-build “diff” for dependency & environment drift
Flags “Known Unknowns” — legacy or unidentifiable libraries

app.mountsmy.com/sbom

app.mountsmy.com/security-drift

03 / SEBI CSCRF

Compliance evidence, in one click.

Toggle “SEBI CSCRF Mode” and PipeLock enforces every mandatory data field, then exports a professional .docx audit pack — cover page, vulnerability summary, the full Annexure-X table, and an OIDC-verified attestation log.

One-click .docx “Audit Pack” export
Cover page with project, build ID & compliance status
Summary table — Critical / High / Medium counts
Annexure-X table with all 10+ mandatory SEBI fields
Attestation log with digital signature & OIDC proof

app.mountsmy.com/audit-pack

Under the hood

Built on tools you already trust

Open standards and battle-tested data sources — no black boxes.

🐹

CLI Agent

🗂

CycloneDX

SBOM Format

🔎

Google OSV

Vuln DB

🛡

GitHub Advisory

Vuln DB

🔐

OIDC

Signing

#️⃣

SHA-256

Integrity

📦

Maven / Ant

Java Builds

⬢

Node.js

npm Builds

🐙

GitHub Actions

☁

Azure DevOps

📄

.docx Export

Audit Pack

⚖

SEBI CSCRF

Framework

How it works

From install to audit pack — 4 steps

No agents to babysit, no spreadsheets to maintain — Security Compliance Management runs inside your pipeline and produces evidence automatically.

Step 01

Onboard

Pick your stack, build tool and OS in a web form — Security Compliance Management generates a one-line install script tailored to you.

Step 02

Capture

The CLI agent records build identity, the full dependency tree, and SHA-256 hashes — then signs it all with OIDC.

Step 03

Analyse

Vulnerabilities are mapped against OSV & GHSA and diffed against your last build to flag any security drift.

Step 04

Export

One click produces a SEBI CSCRF-ready .docx audit pack — Annexure-X, vulnerability summary and attestation log.