Go upstreams can now point to any GOPROXY-compatible module proxy, in addition to the public mirror at 

. This lets you proxy and cache Go modules from private proxies, such as the Buf Schema Registry (BSR), giving you one place to manage, secure, and distribute these Go modules alongside the rest of your organization’s artifacts.

Following early access, policy management - Cloudsmith's policy-as-code system for enforcing rules across your software supply chain - is now generally available across the web app, API, and Terraform provider. This includes:

 write your own logic in Rego, tailored to your specific security and compliance requirements

 policies are evaluated on package upload, and re-evaluated automatically as policies or threat intelligence changes

 hold new package versions back from consumers for a set window before they're trusted

 pre-built starting points so you don't need to write Rego from scratch

 a full audit trail of every policy evaluation, viewable in the web app or downloadable via API

In addition to writing policies that act on package metadata, you can also write policies using Cloudsmith's continuous risk detection, which is also 

Policy management is available as an add-on for Ultra and Enterprise plans. Reach out to your account team to get started.

A separate set of baseline standard policies is included in both plans: CVE, license, package deny, and — newly added — malware policies. The package search field is no longer available when creating vulnerability and license policies in the web app, API, or Terraform. Existing policies using it are frozen and cannot be edited, but remain in place and continue to evaluate.

Policy management and baseline standard policies now live together under 

Creating policies as code in the Cloudsmith web app

For more details about Cloudsmith policy management, see:


Policy management is now generally available

Every package in your workspace is now checked automatically against known vulnerabilities and malicious packages, with no scheduled or manual rescans required. This is powered by 

, which has driven policy evaluation since early access and now also replaces Trivy as the data source shown in the web app and API.

results appear in the web app's workspace, repository, and package-level compliance views, alongside the existing API.

the OpenSSF Malicious Packages feed, added to Cloudsmith in 

, now also flags packages directly in the web app and API.

duplicate advisory records are grouped into one, reducing noise in compliance reviews.

results are sorted by severity across compliance views.

vulnerability detection now covers CRAN, plus Debian/Ubuntu, RPM (Red Hat, AlmaLinux, Rocky Linux), and Alpine packages, whether uploaded individually or bundled in a Docker image.

Detection runs automatically for every supported package format in your workspace, with no configuration required. Cloudsmith refreshes threat intelligence every 5 minutes, and whenever a new or updated record could affect packages already in your workspace, it checks for a match automatically, without requesting a rescan.

Packages are matched to advisories on a shared package URL (PURL). Cloudsmith supports SemVer and ecosystem-native version ranges when matching; see our 

 on ecosystem-native OSV advisory support for more.

The same vulnerability often has multiple records from different upstream databases. Cloudsmith groups these and surfaces one primary record per vulnerability, so counts stay accurate and reviews stay focused. See the Cloudsmith 

 to learn how the primary record is selected.

Packages are sorted by severity, highest first: Malware, then Critical, High, Medium, Low, and Unknown.

Policies can act on this data automatically, quarantining or flagging a package the moment it matches, without manual review. This data has been actionable in policy management with policy as code since we first added it to the platform in early access, and nothing changes for policies you've already built. See the Cloudsmith 

 to learn more about defining policies against this data.

Trivy-based scan results remain available in the legacy web app and via existing API endpoints for now. Trivy will be deprecated in a future release; we'll share migration details ahead of that change.


For more details about continuous risk detection, see 

Continuous risk detection is now generally available

The policy editor now flags Rego problems as you write, so mistakes surface before you save rather than after. In the web app, errors appear inline in the editor and in the error panel; autocomplete also suggests schema fields as you type.

When a policy is saved, the web app and API return errors for:

Type mismatches and incorrect argument counts

Restricted variables in index-applicable policies

The web app editor checks three additional things the API does not: a warning when a policy omits 

 or a match rule, inline highlighting for malformed Rego that doesn't block saving, and autocomplete for schema field names.

Catch policy errors before you save

The Cloudsmith CLI now ships as a standalone, self-contained binary for Linux, macOS, and Windows. This eliminates its dependency on a local Python environment. The CLI includes a new one-line installer, a refreshed Homebrew tap and Docker image, and updated GitHub Actions, Azure DevOps, and CircleCI integrations.

The standalone binary bundles everything it needs at runtime. Installation is now a single download-and-verify step that behaves identically across platforms and CI providers.

Previously, the CLI was distributed primarily as a Python zipapp (

), which requires a compatible Python runtime on any machine and CI runner that uses it. The dependency on a local Python environment often creates extra setup steps, could slow down pipelines, and is susceptible to breaking when the runner's Python version changes.

For each CLI release, we now publish platform-specific binary archives with SHA-256 checksums, attached to a GitHub release and pushed to Cloudsmith. Linux archives also ship a detached GPG signature.

The standalone binaries replace the cloudsmith.pyz zipapp, which will be deprecated.

There are 4 supported installation methods:

 for Windows. The install script detects the platform, downloads the right archive, verifies its SHA-256 checksum, and installs the CLI atomically. Each release also attaches a SHA256SUMS file for verifying the scripts themselves. For reproducible CI builds, pin a specific version instead of latest.

: 
The tap now installs the standalone binary and no longer depends on Python. Existing installs upgrade transparently with 

brew install cloudsmith-io/cloudsmith-cli/cloudsmith

: 
The official cloudsmith/cloudsmith-cli 

 on Docker Hub now ships the standalone binary on a plain Alpine base.

 
If you prefer to run in your own Python environment, you still can do so, via 

Each CI/CD integration for the Cloudsmith CLI now installs the standalone CLI and supports API key and CLI-native OIDC authentication, with no Python or additional dependencies on the runner. 

For migration steps and examples, see the guide for your integration:

: 
Cloudsmith now publishes our CLI artifacts (binaries, Docker images, and Python wheels) to the 

 repository. We are deprecating the existing 

 repository, so you should update any tooling that pulls from the deprecated repository.


The new CI/CD integrations for GitHub Actions, Azure DevOps, and CircleCI orb are major releases with breaking changes. Update your integrations with the migration guide for each.


 handles the upgrade transition automatically. After upgrading, you may have an orphaned python@3.10 dependency, which you can remove with 

CLI 1.20.0 no longer requires Python

At Cloudsmith, we recognize that security is a team sport. Meaningful improvements to our platform have come from researchers and security professionals who take the time to find issues and report them to us responsibly.

Today, we're launching a new bug bounty platform - now live at 

 - built to make it faster, clearer, and more rewarding to submit security-related bugs to Cloudsmith.


Our responsible disclosure program is a cornerstone of how we protect our customers. External reports have helped us discover and remediate vulnerabilities we might otherwise have missed - and almost always before they could affect actual users. Strong security programs are proactive, collaborative, and grounded in a shared goal of keeping the software supply chain safe.

We’ve relied historically on email inboxes and ticket-based systems, but Cloudsmith now serves a far larger enterprise customer base than we did in our early days. It was time to upgrade the process of submitting and processing reports..

The new platform is made for security researchers

With our new platform, each submission flows through a dedicated site designed for speed and transparency, showing researchers where each report stands.

In conjunction with this platform upgrade, we've made a significant change to payout timing. Rewards are now issued once we’ve confirmed a qualifying defect, rather than waiting for a fix to be deployed.

Thank you to our security researcher partners

Security is a shared responsibility, and our program reflects our commitment. We hope our new platform also reflects our commitment to encouraging security researchers to work with Cloudsmith.

If you've found something, we want to hear from you. Learn more at our 

 page. Thank you for helping us keep Cloudsmith secure.

Strengthening security together: Updating our bug bounty platform

The Cloudsmith CLI now eliminates the need for static API keys in CI/CD pipelines by automatically discovering OpenID Connect (OIDC) credentials for all major CI/CD platforms and includes a Docker credential helper to automatically authenticate to Cloudsmith registries.

Static, long-lived API keys in CI/CD pipelines are a security liability and an operational burden: they need to be created, distributed as secrets, rotated, and revoked.

v1.18.0 introduced automatic OIDC credential discovery for AWS. v1.19.0 extends it to every major CI/CD platform, so pipelines can exchange their native workload identity token for a short-lived Cloudsmith token with zero stored secrets.

 in the pipeline, and the CLI does the rest: it detects which CI environment it’s running in, obtains the platform's native OIDC token, and exchanges it with Cloudsmith for a short-lived access token.

All detectors work out of the box with no additional Python dependencies. For fine-grained control, individual detectors can be disabled and the detection order overridden via environment variables, CLI options, or 

With the credential helper, Docker can automatically discover credentials from the CLI, including for custom registry domains. Previously, authenticating Docker against Cloudsmith registries required manual 

cloudsmith credential-helper install docker

 for Cloudsmith registry domains. Custom domains are discovered automatically via the Cloudsmith API and cached.

 against Cloudsmith registries authenticate with the CLI's existing credentials with no docker login.

Automatically discover Docker credentials

The official Docker image now runs as a non-root user

Vulnerable dependencies have been upgraded, resolving all open Dependabot alerts

A packaging fix ensures zipapp (.pyz) builds start correctly on macOS

For a full summary of changes, please visit the 

Configure Go upstreams for any GOPROXY-compatible proxy

Other logs

Policy management is now generally available

Continuous risk detection is now generally available

Catch policy errors before you save

CLI 1.20.0 no longer requires Python

Strengthening security together: Updating our bug bounty platform

CLI v1.19.0: Authenticate automatically with OIDC and Docker credential discovery