Dependency Firewall early access: 50% off the base fee. See pricing

Dependency Firewallvs. JFrog Curation

Both block risky packages before install. Curation runs inside the JFrog Platform on Artifactory. Dependency Firewall works with any registry and is sold as a standalone product.

See pricingBook a demo

Where they differ

From JFrog's public documentation. If something is out of date, tell us.

Works without Artifactory
Dependency FirewallYesPublic registries, Nexus, GitHub Packages, GitLab, Azure Artifacts
JFrog CurationNoNeeds Artifactory, Xray and Catalog
Sold as a standalone product
Dependency FirewallYesA published price list
JFrog CurationNoEnterprise X and Enterprise+ subscriptions only
Dependency confusion protection
Dependency FirewallYesUpstream priority rules, so the private package wins
JFrog CurationPartlyThrough Artifactory repository settings
Different rules per team
Dependency FirewallYesA firewall per team or pipeline, inheriting a baseline
JFrog CurationPartlyPolicies apply per remote repository
Configuration as code
Dependency FirewallYesJSON files in Git, a full API, or the user interface
JFrog CurationPartlyREST API
EU-based vendor
Dependency FirewallYesBitfront AB, Sweden
JFrog CurationNoHeadquartered in the US and Israel

Where they match

  • Works with ArtifactoryDependency Firewall can fetch from Artifactory, or Artifactory can fetch from Dependency Firewall. No plugin. JFrog Curation: Built into the JFrog Platform.
  • SaaSIn the EU, France by default. JFrog Curation: JFrog SaaS.
  • Self-hostedManaged Cloud, BYO Cloud or on-premises, on Enterprise.
  • npm, Maven, PyPI, NuGet, GoIncluding Yarn, pnpm, Bun, Gradle, uv and Poetry. JFrog Curation: Including Gradle.
  • Composer, Cargo, RubyGems, CondaCovered by both.
  • Docker / OCI imagesLayers scanned for malware, secrets and vulnerable OS packages. JFrog Curation: Docker Hub and Docker Hardened Images.
  • Block malicious packagesKnown malware. A separate rule can block install scripts on npm, PyPI and Composer.
  • Block known vulnerabilitiesCVSS and EPSS thresholds per firewall. JFrog Curation: CVE severity conditions.
  • License rulesCovered by both.
  • Hold newly published versionsSafety delay holds new versions, for example 7 or 14 days. JFrog Curation: Immaturity policy, for example 14 days.
  • Exceptions and waiversTime-limited. Developers request them from the blocked install, and the team you choose approves or denies. JFrog Curation: Waivers with an expiry.
  • Audit logEvery block, allow and exception, exportable to your SIEM.

How Dependency Firewall works differently

Works with the registries you already have

Dependency Firewall sits between your package managers and wherever packages come from. It can fetch from Artifactory, or Artifactory can fetch from it. Your other registries stay as they are.

Use case: CI/CD pipeline protectionUse case: AI coding agents

JFrog Curation: Curation evaluates requests to Artifactory remote repositories.

A firewall per team on one baseline

Run a separate firewall per team, pipeline or registry. Each inherits a baseline firewall, whose rules run first and cannot be weakened downstream.

Use case: Policy governance

JFrog Curation: Curation applies policies per remote repository. Different rules per team most often means separate repositories.

Configure in the UI, or as JSON files reviewed as code

Each firewall is a JSON configuration. Review changes in Git, deploy them through the API and roll back.

JFrog Curation: Curation exposes policies through a REST API.

One platform for on-premises and cloud registries

Put Artifactory on-premises and GitHub Packages in the cloud behind the same firewall. One baseline applies to both.

JFrog Curation: Curation evaluates requests to Artifactory remote repositories, so installs that skip Artifactory do not pass through it.

Which one fits

Most teams can tell from which registries they run and how they want to buy it.

Dependency Firewall fits when

  • Your packages come from more than one place: public registries, Nexus, Artifactory, GitHub Packages, GitLab or Azure Artifacts.
  • You run Artifactory on-premises and also use cloud services such as GitHub, and want the same rules on both.
  • You want the firewall as a standalone product, without buying into a repository platform.
  • Each team or pipeline needs its own rules, on top of a baseline nobody can weaken.
  • You want firewall configuration as JSON files in Git, reviewed as code.
  • You want an EU company, with SaaS hosted in the EU.

JFrog Curation fits when

  • You want one vendor for your repository, scanning and package curation.
  • Your JFrog contract already includes Curation.
  • You need a package type Dependency Firewall doesn't cover yet.

Questions

Does Dependency Firewall work with Artifactory?
Yes, both ways. Package managers can point at Dependency Firewall with Artifactory as its upstream, or Artifactory can fetch from Dependency Firewall. There is no plugin.
Do we need to change code or lockfiles?
No. Routing is a package manager setting: a registry URL, a Maven mirror entry, a GOPROXY value or a docker login. Code, manifests and lockfiles stay as they are.
Can each team have its own rules?
Yes. Create a firewall per team, pipeline or registry. Each can inherit from a baseline firewall, whose rules run first and cannot be weakened downstream.
Where is Dependency Firewall hosted?
The SaaS runs in the EU, on Scaleway in France by default, with AWS in the EU on request. Enterprise adds Managed Cloud, BYO Cloud and on-premises deployment. Bitfront AB is a Swedish company.
How is Dependency Firewall priced?
Cloud is priced on the largest of three meters: active users, packages scanned or downloads served. There is no overage. Enterprise is a custom agreement. See the price list.

Run it in front of your current repository

Point one package manager at Dependency Firewall and read the decisions in the log. No agent installs, no workflow changes.

Start a free trialBook a demo