0507Attestation
A branded public page that shows reviewed third-party licenses for a shipped product. Health scores, snapshot history, page watchers, and optional custom domain, built for procurement reviewers.
Last updated: July 19, 2026
Attestation pages
Enterprise procurement wants a link they can paste into a security questionnaire, not a PDF someone rebuilt last quarter. Each project publishes a branded, server-rendered attestation page with approved packages and full license text.
Each published project gets a stable public URL with approved packages, confirmed licenses, and complete license text. Designed for procurement reviewers with fifteen minutes and a checklist, not developers reading raw manifests.
Paste the link in your RFP response instead of scheduling another diligence call.
A procurement-friendly completeness meter shows how much of the inventory is reviewed and publishable. Buyers see confidence at a glance; your team sees what still blocks publish.
Every publish creates a frozen revision. Compare snapshots, see what changed since the last publish, and keep archived attestation pages live forever: Buyers bookmark a URL that stays valid.
Procurement contacts can subscribe to revision updates by email. When you republish after a dependency change, subscribers get notified: An engagement loop that keeps proof current without manual outreach.
Default pages live at sourcetrust.app/acme/platform-style URLs: Your organization, then the project. The optional custom domain add-on ($49/mo or $499/yr per organization) serves every project at your hostname, like licenses.yourcompany.com/platform.
Optional password gate with bot protection, publisher signatures on snapshots, and a SourceTrust trust seal on public pages. Deliberately not a raw SBOM: License posture and attribution, not an attack-surface map.
Attestation pages publish the legal and compliance subset: Component identity, license posture, notices, and attributions. They deliberately omit version-exact detail that would help attackers cross-reference known vulnerabilities.
Optional security monitoring ($200/mo or $2000/yr per organization) scans for OSV advisories on your side only, findings never appear on the public page.
License attestation is a maintained, buyer-facing record that a specific product ships with reviewed third-party licenses and obligations. It is not a marketing claim and not a raw SBOM dump. It is the page procurement opens when they ask for proof.
Automation helps when the page is tied to import, review gates, and frozen publish snapshots. Without that loop, attestation goes stale the moment dependencies change.
Because questionnaires and diligence checklists need a stable URL they can reopen later. A PDF emailed once does not update when your lockfile does. A reviewed page with snapshot history does.
Scanner reports help your team find issues. Attestation is the controlled subset you are willing to represent externally: component identity, license posture, notices, and attributions, after human review.
For the person who receives the link
The first thing on every page is what a vendor reviewer actually needs: A conservative copyleft verdict, a letter grade they can paste into a risk dashboard, and a named human who signed the review. Readable in minutes, not a PDF to decode.
Your page, your rules
The page must not look or behave like a third-party tool. Brand it, serve it from your own domain, and control exactly who can read it.
A hex brand color drives the top border, links, and accents; drop in a logo or keep the monogram. The recolor applies live.
Serve every page from your own hostname with a per-provider DNS guide and a Check DNS button. Up to ten hostnames per organization.
licenses.acme.com/platform
Gate any page behind a shared password with an invisible Turnstile check. Readable for a procurement reviewer, closed to crawlers, and forced noindex.
An authenticated preview renders the real page from your current inventory behind a Preview, not published banner. Built from the same component as the live page, so it can never drift.
Your org root lists every published page with revision and package counts. Toggle it off if you'd rather not.
sourcetrust.app/acme
Every page carries a verifiable seal with the Snapshot ID, and exports a QR code for slide decks, packaging, and vendor portals.
Continue reading
One idea per page: Follow the path that matches your next question.
Stop shipping on assumptions
Set up a project for each repo, review your obligations, publish when ready, and keep the record aligned with every release. Download license and attribution files when engineering needs them, with pipeline checks so the next update does not undo what you already approved. Your SOC report is not a substitute.
Not ready to start yet? View pricing
Cookies on sourcetrust.dev
We use essential cookies for security, including abuse prevention on our site scan and walkthrough request form. With your permission, we also use optional analytics and diagnostics (Google Tag Manager on this site, and the Sentry browser SDK on the SourceTrust application when configured). See our cookie policy.