Product

Overview

How it works Watch it work All 35 features Screenshots How ForgeRepo™ is secured

Keep bad packages out

Malware scanning Typosquat detection Dependency confusion protection Cooling off new releases Allow lists and block lists

When something goes wrong

Kill switch Who has it Lockdown and degraded modes Vulnerability monitoring

Developers and approvals

Requests and auto approve Check, walk and review Waivers Dry run
Formats

Languages

Private npm registry PyPI proxy and private index Private NuGet feed and proxy Maven repository proxy RubyGems mirror Composer and Packagist proxy

Apple, containers and Linux

CocoaPods CDN mirror Swift package registry Docker registry mirror RPM mirror for dnf and yum APT mirror for Debian and Ubuntu

Use it as

An npm firewall Artifacts, SBOMs and lifecycle More than one node SSO, roles and allow lists
Learn

Guides

Learn secure development Secure coding Secure pipelines Unsafe vs safe Security and development

Supply chain

Supply chain attacks, 2016 to 2026 Software supply chain security
Compare Side by side, all four ForgeRepo™ vs JFrog ForgeRepo™ vs Sonatype ForgeRepo™ vs Cloudsmith
Docs

Start

Getting started Download All documentation Questions

For developers

npm setup pip setup docker login Push a Docker image CI basics

For administrators

First setup Rules and their order Six incidents, walked through Backup and upgrade
Pricing Install it
  1. Home
  2. Learn

Learn

Safe code, through safe pipelines

Practical guides for developers, security engineers and the people who run the build servers. Each topic shows the unsafe way beside a safer one, in real languages and real pipeline files, and points to the primary sources: OWASP, NIST, SLSA, OpenSSF and Sigstore.

Start with secure coding See the gallery
A diverse team of developers at laptops writing code, with a pipeline carrying their commits through build and test, past a registry firewall, to build serversapp.tstestcommitbuildtestbuild serversregistryfirewall

The guides

Four pages, each readable on its own. Free, no sign up, written for 2026 tooling.

A code window with a shield, for secure coding

Secure coding guide for developers

Validation and encoding, injection, access checks, secrets, dependencies, errors, crypto and review, each with an unsafe and a safer example.

Read the guide Pipeline stages flowing to a build server, for CI/CD security

CI/CD pipeline security

Jenkins, GitHub Actions, GitLab CI, Azure DevOps, CircleCI, TeamCity and Bamboo, hardened, and mapped to the OWASP CI/CD risks.

Read the guide An unsafe card with a cross beside a safer card with a check

Unsafe vs safe, side by side

A visual gallery of common mistakes beside the safer way: code, dependencies, pipelines, secrets, containers and infrastructure.

Read the guide Two people from security and development sharing one pipeline

Security and development, working as one team

Shared goals, champions, paved roads, ownership, triage SLAs, exceptions that expire, a maturity model and a 30/60/90 day plan.

Read the guide

Learning paths

Short routes through the guides for the role you have. Each step is one section, about five minutes.

Developers

Write code that holds up, and keep what you pull in honest.

  1. Validation, encoding and injection
  2. Object level access checks
  3. Secrets out of code
  4. Dependency hygiene
  5. SAST in the editor and the pull request
  6. The unsafe vs safe gallery: code

Security teams

Put guidance where developers already work, and make findings worth fixing.

  1. What maps to the OWASP Top 10:2025
  2. Threat modeling basics
  3. Triage and SLAs for findings
  4. Cutting false positives
  5. Exceptions that expire
  6. The OWASP CI/CD risks

Platform and DevOps

The build system is production. Treat it that way.

  1. GitHub Actions hardening
  2. Jenkins hardening
  3. OIDC instead of stored cloud keys
  4. Lockfiles and a registry firewall
  5. Provenance, SLSA and signing
  6. Containers and infrastructure

Leads and managers

Make the safe way the easy way, and measure it.

  1. Shared goals and metrics
  2. Who owns what
  3. Security champions
  4. A maturity model
  5. A 30/60/90 day plan
  6. Where a registry fits in supply chain security

The frameworks behind the guides

These are the primary sources. When a guide says "OWASP recommends" or "SLSA Build L2", this is where it comes from.

  • OWASP Top 10:2025
    The ten most critical web application risks, 2025 edition. Supply chain failures are now A03. The OWASP Top 10:2021 edition is still widely referenced.
  • OWASP ASVS 5.0
    The Application Security Verification Standard: testable requirements to design against and verify, at three levels.
  • OWASP Top 10 CI/CD Security Risks
    CICD-SEC-1 to CICD-SEC-10: flow control, identity, dependency chain abuse, poisoned pipelines, credentials and more.
  • SLSA build levels
    Supply chain Levels for Software Artifacts. Build L1 to L3: provenance exists, is signed by a hosted platform, then comes from a hardened one.
  • NIST SSDF, SP 800-218
    The Secure Software Development Framework, version 1.1. A version 1.2 draft (SP 800-218 Rev. 1) was published for comment in December 2025.
  • OpenSSF Scorecard
    Automated checks for open source projects: pinned dependencies, token permissions, branch protection, dangerous workflows, signed releases.
  • Sigstore
    Free signing and verification for software artifacts, keyless through OIDC identities, with a public transparency log.
  • OWASP Cheat Sheet Series
    Short, specific guidance per topic. The guides here link to the relevant sheet for each section.

Where ForgeRepo™ fits

The guides are tool neutral. Two parts of them are where ForgeRepo™ does the work: every dependency your code and your pipelines pull goes through one gate, and you can answer "who pulled this?" in seconds when a package turns out to be malicious. It is free and self hosted.

For the code itself, reading it for injection, leaked secrets and risky patterns, the same author wrote Git Code Review, a free SAST and code review tool.

Supply chain security Ten years of supply chain attacks

Cooling off new releases

Brand new versions wait a few days before your builds see them, which is when hijacks get caught.

Read more

Malware scanning

ClamAV, a hash blocklist, your own scanner and the OpenSSF known malicious feed, on every cached file. Optionally before the first download.

Read more

Put a gate in front of every dependency

The guides tell you to stop pulling straight from public registries. ForgeRepo™ is one container that does it for npm, PyPI, Docker, NuGet, Maven and more. Free, MIT licensed.

Getting started Read the docs