The SCANOSS App reports presence of known Open Source software in your code that is not declared in your SBOM.json file.

When you install the application, an initial scan will be launched on the entire code of each repository where you have enabled the application. Once the scan is completed, declare your Open Source components in the SBOM.json file in the root folder. From that point, every commit including OSS code not declared will be raised as an issue.

Sample SBOM.json.

[
  {
    "component": "mycomponent",
    "type": "implementation",
    "comment": "This is your component"
  }
  {
    "component": "webhook",
    "type": "dependency",
    "comment": "This is an OSS component that you are using inside your component"
  }
]

IMPORTANT: Make sure that the repositories where you want to install this app have issues enabled. Otherwise the initial scan will not be reported.