It would be ideal if the output SBOM of syft included a description of what is in scope and out of scope as clearly as possible. This includes (but not limited to):

• which catalogers were used during the SBOM generation process
• what was the configuration of each cataloger (should be covered in the app config section already)
• what paths were included in the search vs excluded from the search (as input)
• what paths were attempted to be parsed/searched but could not be for various reasons (IO error, permissions error, parse error)

Why? A good SBOM describes the positive cases of "what" was actually found (X packages, Y files, etc). A great SBOM should describe negative conditions. This doesn't apply to the cases themselves, such as "list all of the packages you didn't find" (which makes no sense), but instead the runtime, configuration, and environmental factors that lead to "places not searched". This helps SBOM consumers better reproduce results and understand the boundaries of what was "in scope" vs "out of scope" during the analysis.