When an exposed Cloudsmith API key is detected in a GitHub repository, the email notification sent to the affected Cloudsmith user and workspace owners now lists every location the key was found in GitHub, with a direct link to each detection.

Pull request titles, descriptions, comments, and reviews

The Cloudsmith workspace audit log records an 

 event for each detection, with the masked key and detection location.

Exposure detection for Cloudsmith API keys in GitHub runs through the 

You can now apply cooldown policies to Cargo packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.

You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

This feature is available for Ultra and Enterprise customers using policy management with policy as code.

Cooldown policies are now supported for npm, Python, Go, Maven, NuGet, Conda, Docker, and Cargo. For more information about using cooldown policies, see 

Cooldown policies now support Cargo

You can now apply cooldown policies to Conda and Docker packages, protecting your supply chain from newly published versions that may carry malware or have not yet undergone sufficient community scrutiny.


You can create cooldown policies via the Cloudsmith API, Terraform provider, and web app.

Cooldown policies are now supported for npm, Python, Go, Maven, NuGet, Conda, and Docker. For more information about using cooldown policies, see 

Cooldown policies now support Conda and Docker

See how published packages are being consumed - downloads, entitlement token use, and client logs - without leaving the Broadcasts app.

See how many public, open source, and private packages are currently broadcasting and how many entitlement tokens (authentication tokens used to track and control package downloads, often issued per customer) have been active this billing cycle, alongside usage by repository and your most-downloaded packages.

An interactive world map shows download distribution, with a sortable table of usage and request counts by country. Filter by usage period, date range, country, and broadcast.

View a timestamped event stream of package requests, which you can filter by status code, package format, IP address, country, and more.

Track downloads, token use, and client logs in the Broadcasts app

Library registries provide a vendor-curated feed of open source packages. Packages may be pre-vetted, rebuilt from source, and security scanned by the vendor. For details on which of these features are available for a specific registry, see the latest documentation for the registry vendor.


Currently supported quick configure vendors:

Pick a vendor and library, name the upstream, and add your credentials - Cloudsmith fills in the proxy URL for you.

Other library registries can still be added as upstreams by using manual configuration. To register interest in additional quick configure vendor support, please 

Quickly configure library registries as upstreams with the new Libraries tab

Cloudsmith now supports the Nix format, letting you host a public or private Nix binary cache, complete with Ed25519-signed packages and upstream proxying and caching against NixOS release channels. Your existing 

 workflows point directly to Cloudsmith, with no new upload tooling required, and no self-hosted cache such as 

Nix packages are content-addressed by store path rather than name and version, so packages are pushed to Cloudsmith using the native 

 command instead of a CLI or website upload:

 flag is required because a locally built store path is unsigned; Cloudsmith signs it server-side using the repository's Ed25519 signing key.

Cloudsmith signs on every read rather than at upload, so a key rotation applies to all packages immediately with no backlog to re-sign, and multiple keys can be valid at once.

To consume packages, add the repository's public key to 

 in your Nix configuration (or per-invocation via 

). Without it, Nix will refuse to substitute packages even though the HTTP request itself succeeds.

A Nix upstream points at a single NixOS release channel, for example, 

When a requested store path isn't cached locally, Cloudsmith fetches it from the configured channel, caches it, and serves it signed with the repository's key.

Nix always resolves a package's full dependency closure before installing. On NixOS channels, dynamically-linked packages resolve to a 

 build whose closure includes a GCC bootstrap intermediate (

) that isn't published in the channel's manifest, so Cloudsmith cannot index or serve it. As a workaround, configure 

 as an additional fallback substituter alongside your Cloudsmith repository.

The Nix format is available in Early Access. For more details, see the 

New format: Nix, with upstream support for NixOS

Go upstreams can now point to any GOPROXY-compatible module proxy, in addition to the public mirror at 

. This lets you proxy and cache Go modules from private proxies, such as the Buf Schema Registry (BSR), giving you one place to manage, secure, and distribute these Go modules alongside the rest of your organization’s artifacts.

GitHub secret scanning notifications now link to each detection location

Other logs

Cooldown policies now support Cargo

Cooldown policies now support Conda and Docker

Track downloads, token use, and client logs in the Broadcasts app

Quickly configure library registries as upstreams with the new Libraries tab

New format: Nix, with upstream support for NixOS

Configure Go upstreams for any GOPROXY-compatible proxy