Comment by h4ck_th3_pl4n3t

That is literally how the CycloneDX SBOM packages work, well, after the fact and after the disclosure process.