Secure Registry

Available for Enterprise Tier only

Secure Registry is an authenticated upstream registry that sits between your developers, CI runners, and the public package registries (npm, PyPI, Maven, NuGet and Go). Every metadata request and tarball download flows through Secure Registry, which evaluates it against your configured security controls before returning a response. Requests that violate a control are blocked or modified at install time, regardless of whether the install runs in CI or on a developer's laptop.

How it compares to GitHub Checks

Secure Registry complements Package Cooldown and Package Compromised Updates in GitHub Checks. The two enforce at different points in the dependency lifecycle:

	GitHub Checks	Secure Registry
Enforcement point	Pull request	Package install
What it sees	Manifest and lockfile changes in a PR	Every install request from any configured client
Scope	Repositories under StepSecurity GitHub Checks	CI runners, developer machines, and artifact managers configured to use Secure Registry
Result of violation	PR check fails, blocking merge	Request is blocked or the response is modified at install time
Ecosystems	npm, PyPI, Maven, NuGet	npm, PyPI, Maven, NuGet, Go

Using both gives you layered protection: PRs cannot introduce known-bad dependencies, and environments that bypass PR review (developer laptops, ad-hoc CI scripts, fresh clones with floating versions) cannot install them either.

How it works

• Step 1: Configure your developers' package clients (e.g npm), CI runners, or your artifact repository manager (JFrog Artifactory, Google Artifact Registry) to use the Secure Registry URL as the upstream registry.
• Step 2: Every package request flows through Secure Registry, which evaluates it against the controls you have enabled for that ecosystem.
• Step 3: Each evaluation is recorded in the Policy Evaluations log and visible in your StepSecurity dashboard.

Follow this interactive demo to see how it works:

Supported ecosystems

Ecosystem	Status	Upstream registry
npm	Available	npm registry
PyPI	Available	PyPI and the PythonHosted file host
Maven	Available (Beta)	Maven Central
NuGet	Available (Beta)	NuGet.org V3
Go	Available (Beta)	Go module proxy and the Go checksum database

In this section

• Policy: configure the security controls Secure Registry enforces (Cooldown Period, Compromised Packages, Custom Block List, Released Tags Only, Typosquatting Protection), per ecosystem.
• Policy Evaluations: review the audit log of every request that flowed through Secure Registry, including the source machine or workflow run behind each one.
• Setup Guide: get your credentials and configure your package manager to proxy through Secure Registry, including optional source attribution.
• Service Level Agreement: the uptime commitment for the proxy endpoints, how it is measured, what is excluded, and the malicious package blocking commitment.