New package formats added for vulnerability scanning
Package vulnerability scanning is a key step in securing your software delivery pipeline and reducing the risk of releasing insecure software into production.
Cloudsmith makes it easy for your team to introduce vulnerability scanning by automatically scanning every supported package format pushed to a Cloudsmith repository or fetched from a caching-enabled upstream.
Cloudsmith surfaces the scan results in the application's user interface and API, and has support for setting up webhooks based on scan events. With the recently released quarantine status for packages, you can now automate quarantining packages based on the results of a vulnerability scan.
Cloudsmith's vulnerability scanning feature is available for the following package formats:
- Docker
- Ruby
- Python
- Composer
- Maven
- NuGet
- Golang
- Cargo
- npm
As always, please contact us at support@cloudsmith.com if you have any questions or comments on this new feature.