Louann Duclos

JavaScript, Python, SBOM (CycloneDX), OSV, CISA KEV, EU Cyber Resilience Act, security, compliance, open source

crakit.eu and the crakit-cli npm package: SBOM + known exploited vulnerabilities in CI, for the CRA reporting duties that apply from 11 September 2026.

Questions on the EU Cyber Resilience Act from small software vendors: scope edge cases, SBOM formats, the 24 h / 72 h reporting duty. Corrections welcome.