Software Supply Chain Security Features | Cloudsmith
Platform Features
Policy management
Centralize control over your entire software supply chain - every package, dependency, format, and team - before software reaches developers, pipelines, or production.
Cooldown policies
Hold new package versions back for a set window so nothing untested lands in a build and package managers just resolve to the latest version that passes.
Security and Compliance Features
Features to safeguard your teams, customers, and reputation. Cloudsmith is a central checkpoint for software integrity.
- Continuous risk detection: Surface newly disclosed risks automatically with continuous monitoring of packages against the latest security advisories.
- Standard policies: Protect against CVEs, license compliance violations, malicious packages, and unwanted packages with built-in policy types. Docs
- Policy as code: Define rules with OPA/Rego, enforced automatically across every pipeline. Docs
- Cooldown policies: Prevent newly published packages from being consumed until a configurable time window elapses. Docs
- Upstream trust: Prevent trusted packages from being overridden by identically-named packages from untrusted sources. Docs
- Package quarantine: Prevent packages from being distributed to teams and pipelines when they fail policy checks. Docs
- Generate SBOMs for containers: Automatically generate SBOMs for container images including transitive dependencies and license metadata. Docs
- Host SBOMs: Store and distribute SBOM files alongside their corresponding packages or container images. Docs
- License reporting: Report on license types across repositories and organizations to support compliance management. Docs
- Package signing: Sign uploaded packages automatically with GPG or RSA. Docs
- Custom signing keys: Ensure packages have not been tampered with by signing with your own custom encryption keys. Docs
- Sigstore cosign support: Automatically verify your packages as part of your build pipeline using Sigstore. Docs
- Geographic location / IP restrictions: Ensure your software doesn't flow to problematic territories or specific IP ranges. Docs
- Custom storage regions: Remain in compliance with your corporate standards by specifying storage regions for your software artifacts. Docs
- Malware scanning: Inspect package, container, and dependency contents for known malware signatures using ClamAV, included on every Cloudsmith plan. Docs
- Malicious package detection: Match every package against the OpenSSF Malicious Packages dataset via OSV.dev, catching typosquats, dependency confusion, and compromised maintainer releases. Docs
- Vulnerability scanning: Automatically scan supported package types for CVEs on upload, with on-demand and API-triggered rescans. Docs
- Continuous Security: Re-match existing artifacts against newly published vulnerability and malicious package data on an hourly basis, triggering policy action the moment a new threat appears. Early access with Enterprise Policy Manager. Docs
- Block until scan: Hold packages back from distribution until malware, vulnerability, and policy checks complete, so nothing reaches a pipeline unscanned. Docs
- GitHub secret scanning: Detect leaked Cloudsmith API keys and entitlement tokens committed to GitHub automatically, as a GitHub secret scanning partner. Docs
- Policy exemptions: Exclude specific packages from policy evaluation for legitimate exceptions, such as a legacy app that depends on a flagged version. Docs
Access Control Features
Features to control who can access the packages, containers, models, and data managed in your Cloudsmith workspace.
- Single sign-on via social auth: Use your existing social sign-on provider to authenticate against Cloudsmith.
- Teams (team-based controls): Assign privileges and permissions to groups of users organized in teams. Docs
- Service accounts: Allow bots and services to interact with your Cloudsmith resources using dedicated service accounts. Docs
- Log exports: Take your log data away for further analysis with automated log exports. Docs
- OpenID Connect: Use ephemeral OIDC tokens to connect Cloudsmith with third-party services, without long-lasting credentials. Docs
- Single sign-on via SAML: Use your existing ID provider like Okta to authenticate Cloudsmith users. Docs
- SAML groups: Model your org's teams and permissions in your ID provider, and automatically map to Cloudsmith. Docs
- SCIM: Automatically reflect changes to your real-world org in your Cloudsmith teams and users. Docs
- API key policies: Mitigate against security breaches by ensuring keys are updated regularly and automatically invalidated. Docs
Frequently Asked Questions
1. What types of policy can I enforce on packages?
Standard policies cover vulnerabilities, licenses, malware, and package deny rules. For anything more specific, write your own policy as code in OPA Rego and enforce it across every repository and format.
Policy management documentation
2. How do cooldown policies work?
A cooldown policy holds back newly published package versions until a window you set has passed, giving the security community time to vet them. Package managers resolve to the latest compliant version instead.
3. How does Cloudsmith detect malicious packages?
Detection runs automatically for supported formats, with no configuration required. Packages are checked against trusted threat intelligence on upload and again on a recurring basis, so newly identified malicious packages are matched against artifacts you already hold. Results feed into your policies, so you can quarantine matches automatically.
Malicious package detection documentation
4. Does Cloudsmith scan packages for vulnerabilities?
Yes. Cloudsmith automatically scans supported package types for CVEs on upload, and you can trigger further scans from the web app or the API. Scan results can drive policy actions such as quarantine.
Vulnerability scanning documentation
5. How does Continuous Security keep risk data current?
Continuous Security re-matches artifacts already in your workspace against newly published vulnerability and malicious package data. When a new threat appears, your policies re-evaluate the package and take action without a manual rescan.
Continuous Security documentation
6. Can I generate SBOMs and sign packages?
Yes. Cloudsmith generates SBOMs so you can trace exactly what each package contains, and signs the packages you publish so downstream consumers can verify authenticity and integrity before use.