sbom.spdx.json
results.sarif