FerroSCA - Rust-native SBOM / SCA and vulnerability-management server

FerroSCA is a Rust-native SBOM (Software Bill of Materials) / SCA (Software Composition Analysis) and vulnerability-management server packaged as a hardened Amazon Linux 2023 AMI on AWS Graviton (arm64). It ingests CycloneDX 1.4 / 1.5 / 1.6 (JSON and XML) and SPDX 2.2 / 2.3 SBOMs, correlates the components against public vulnerability data (NVD JSON 2.0, OSV, public advisory feeds, and the CISA KEV catalogue), scores findings with CVSS v2 / v3 / v4 and EPSS, evaluates policy, and exposes the results over a REST API. The server runs as a single Rust process: there is no JVM, no separate front-end tier, no separate worker tier. It starts in under a second, idles under about 256 MB of RAM, and embeds its dashboard in the same binary. What FerroSCA does today (v1.0 line): SBOM ingest of CycloneDX 1.4 / 1.5 / 1.6 (JSON + XML) and SPDX 2.2 / 2.3, with streaming upload, a memory ceiling, and token-based async processing; SBOM export to CycloneDX, SPDX, VDR, and VEX; vulnerability intelligence from NVD JSON 2.0, OSV, public advisory feeds, and the CISA Known Exploited Vulnerabilities catalogue, with EPSS enrichment and CSAF 2.0 / VEX 1.4 consumption plus air-gapped mirror import; Package URL 0.6 and CPE 2.3 identifiers, CVSS v2 / v3 / v4 and EPSS scoring, and distro-aware matching for Alpine, Debian, and Ubuntu base images; a policy engine with 30+ conditions plus SPDX license detection and reporting; notifications over Email and Webhook (with adapter slots for chat-platform webhooks and issue-tracker webhooks); local-user authentication with SHA3-256 API keys, OIDC, LDAP (gated), TLS via rustls, and project-level ACL on mutations. Engineering posture (verifiable from the shipped artefacts): #![forbid(unsafe_code)] in every crate, clippy clean at -D warnings CI-enforced workspace-wide, a no-unwrap()/expect()-in-production-code convention, a full workspace test suite (over 13,000 tests at the v1.0 release tag), a cargo-deny supply-chain gate, a CycloneDX SBOM and self-VDR produced during the AMI bake, fuzz-targeted SBOM and PURL parsers, and a published KNOWN_LIMITATIONS document. The AMI is hardened (SELinux enforcing, fail2ban enabled, automatic security updates via dnf-automatic, systemd ProtectSystem=strict / NoNewPrivileges / capability bounding set emptied), and ships unique per-instance secrets (admin password, session secret, API key pepper) generated from /dev/urandom on first boot, with the admin account flagged forcedPasswordChange so the buyer must change the password on first login. Honest scope (please read before purchasing): PostgreSQL, SQLite, and the embedded sled storage backend are supported; MySQL is excluded from the build. FIPS-validated crypto, SPDX 3.0 ingest, and a third-party security audit are roadmap. The supported Marketplace topology is single-node behind an Application Load Balancer. Refer to the KNOWN_LIMITATIONS document shipped with the AMI for the full list. Entitlement and billing run entirely through AWS Marketplace: this is a standard hourly-plus-annual per-instance-type AMI product, metered automatically by AWS per running EC2 instance-hour. There is no separate license server, no out-of-band activation key, and no external transaction of any kind required to use the product.