I had to scratch one of my itches. I have to work with SBOMs and I couldn't find something, so I'm announcing blitsbom — a zero-install, browser-only SBOM viewer.
Drop a CycloneDX or SPDX bom.json on the page, get a searchable view of every component, license category (FSF-classified), and — if you add a VEX file on top — known CVEs with severity. URL-encoded filters so you can share a view. CSV export for legal.
Every byte stays in your browser. No upload, no telemetry, no CDN. Works offline from file:// on an air-gapped machine. ~60 KB gzipped JS, 50 MB ~325 kB Docker image, MIT.
If you've ever wanted to just look at an SBOM without onboarding a platform — this is that.