Software supply chain
Raeburn uses software-supply-chain controls on an implementation-by-implementation basis. We publish an SBOM or scanning claim only where the relevant repository or deployment is actually configured to produce that evidence.
This Group repository includes automated SBOM generation. Other applications are treated separately: an SBOM is not assumed to exist merely because a project belongs to the Group. Where enabled, machine-readable inventories may use standards such as SPDX or CycloneDX according to the configured workflow.
The Group external-assurance workflow currently runs language-native dependency audits against selected public repositories where supported dependency files are present. Raw outputs are retained even where an audit command reports findings.
Selected public repositories are checked for likely secret exposure using automated scanning. This is a detection control, not a guarantee that every credential or sensitive value will be identified.
Linting, type checking, tests, SAST/CodeQL, production builds and deployment verification are repository-specific. The Trust Centre only represents them as operating where the relevant configuration is present and evidence exists.
An SBOM is an inventory and transparency control. It is not a security certification, does not prove that software is vulnerability-free and does not replace secure development, dependency remediation, secret management, testing or independent assurance.
Last reviewed: 29 August 2026.