How to use Cloudsmith as a dependency firewall
A practical guide to building a dependency firewall with Cloudsmith, from upstream configuration and cooldown policies to the GitOps exception workflow and decision log auditing…
Cloudsmith credentials are now detectable by GitHub Secret Scanning
Leaked API keys are one of the most common and well-understood security failures in software development. A credential committed to a repo, copied into a script, or exposed in a CI log can sit undetected until abuse makes it visible. By then, the damage is done.
Cloudsmith is now a member of the GitHub Secret Scanning Partner Program. That means Cloudsmith-issued API keys are uniquely identifiable, and GitHub can detect them automatically when they appear in a repository.
How it works
Cloudsmith issues API keys with a unique prefix. That prefix is registered with GitHub's secret scanning infrastructure, so when a Cloudsmith credential appears in a repo – in source code, a config file, a committed .env, or anywhere else GitHub indexes – GitHub detects and flags those credentials automatically.
When a leak happens, Cloudsmith notifies the affected customer directly. Teams can revoke or rotate the compromised key before it gets misused.
The workflow is straightforward: detection happens automatically, notification is immediate, and your team decides how to respond.
Why this matters for your team
The window between a credential leak and credential abuse is short and it closes fast. Automated scanners can pick up a key exposed in a pull request or pushed to a public repo within minutes. Discovering issues through billing anomalies or abuse reports put teams in a challenging position, and one they want to avoid.
Automatic detection of leaked API keys changes that dynamic. When exposure triggers an immediate notification, the response begins before most incidents have a chance to develop.
This works inside the workflows your team already uses. There is no new tooling to adopt, or new configuration required on your end. GitHub-based teams get detection in place from the moment they issue their next Cloudsmith API key.
See how Cloudsmith secures your software supply chain end to end. Book a demo to learn more.
More articles
01/06
A dependency firewall gives your scanner better inputs
Modern supply chain attacks don't exploit vulnerable code – they target trusted packages and execute before any scanner runs. Here's the structural gap behind every missed malicious package, and where the control point should actually be…
Dependency attacks start before your scanner runs
Most security tooling catches threats after packages already enter your environment. A leaked npm key reveals why that timing matters, and where enforcement needs to happen instead…
Inside the Mastra npm supply chain attack
On June 17, a typosquatted npm package and stolen contributor credentials gave attackers access to 144 Mastra packages with nearly a million weekly downloads. Here's how the attack unfolded, how the malware evaded detection, and how to protect your pipeline…
How Cloudsmith cooldown policies block newly published packages without disrupting your builds
Cooldown policies at the index level mean your package manager resolves to compliant versions automatically. Cloudsmith implements this for npm and Python…
The EU Cyber Resilience Act: What engineering teams need to do to be compliant
The EU Cyber Resilience Act (Regulation EU 2024/2847) is the first EU-wide regulation that places mandatory cybersecurity requirements on digital products throughout their entire lifecycle, from design and development all the way through deployment and end-of-life…