A project holds one product's third-party packages and its public attestation page. Most companies have one project per product or service.
Project names can be reused. Each project has a URL slug that must be unique within its organization: sourcetrust.app/your-org/your-project. Other organizations have their own URLs. Pick a short, stable slug; changing it later changes the page address. The optional description appears in your project overview and on the published attestation page.
The Inventory source step asks how this project gets its dependencies. Pick Upload a file and the new project opens with the upload dialog ready, so you are not asked to choose a source a second time. The choice is used once: reloading the project page later does not reopen the dialog.
While creating a project, admins can optionally assign Project leads so dependency digests and security alerts go to the right people from day one. See Help center → Project leads (Project leads).