diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0320f1e..71b9b24 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -7,6 +7,9 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ## [Unreleased]
 
+### Changed
+- Native binary caps heap at 256MB (`-R:MaxHeapSize=256m`, overridable per run with `-Xmx`); SBOM emits JSON only.
+
 ## [1.3.0] - 2026-09-23
 
 ### Breaking
diff --git a/README.md b/README.md
index 2ab6785..7353d09 100644
--- a/README.md
+++ b/README.md
@@ -533,6 +533,9 @@ A: Honestly, it's your choice. For instance, I use OpenRouter mainly since you c
 **Q: Does this send my code to AI providers?**  
 A: It sends the git diff (changes only), not your entire codebase. Before sending, the diff is scanned locally: secrets (API keys, private keys, tokens, credentialed URLs), binary content, generated lockfiles, and diffs over 64KB are refused and never leave your machine. Provider base URLs must be https except for loopback hosts. Use Ollama for fully local processing with zero external API calls.
 
+**Q: How much memory does it use?**  
+A: The native binary caps its heap at 256MB (worst-case RSS stays well under 1GB, versus 80% of RAM uncapped). Override per run with `./ai-commit -Xmx1g` if you ever need more.
+
 **Q: When should I use auto-commit vs interactive mode?**  
 A: Use **auto-commit** for rapid development when you trust the AI (small, frequent commits). Use **interactive mode** when you want to review messages carefully (large changes, important commits).
 
diff --git a/pom.xml b/pom.xml
index e9af2fd..ebcd0b7 100644
--- a/pom.xml
+++ b/pom.xml
@@ -185,6 +185,7 @@
                         <buildArg>-H:+ReportExceptionStackTraces</buildArg>
                         <buildArg>--initialize-at-run-time=io.netty,reactor.netty</buildArg>
                         <buildArg>-march=compatibility</buildArg>
+                        <buildArg>-R:MaxHeapSize=256m</buildArg>
                     </buildArgs>
                 </configuration>
             </plugin>
@@ -254,6 +255,9 @@
                         <goals>
                             <goal>makeAggregateBom</goal>
                         </goals>
+                        <configuration>
+                            <outputFormat>json</outputFormat>
+                        </configuration>
                     </execution>
                 </executions>
             </plugin>