The next generation Bytesafe Dependency Firewall intercepts every package request before it reaches developers, CI/CD pipelines or AI agents. Block malicious, vulnerable and policy-violating packages in real time, with every decision logged and explained. Existing customers get a supported migration path.
The way teams consume open source has changed. Dependencies enter through developers, CI/CD pipelines, automation, AI coding tools and internal repository flows. The previous-generation firewall was built around a hosted registry and proxy model that predates this picture.
The next generation Dependency Firewall is designed as a standalone control point. It intercepts package requests from all of these sources, evaluates them against policy and passes decisions to your existing repository. Think of it like a network firewall, but applied to open source dependencies instead of network traffic.
The policy engine is new from the ground up: more granular rules, live decision logs, malware scanning and exception management that the previous-generation firewall does not have.
Capabilities not available in the previous-generation firewall.
Rules based on package name, version range, age, license, vulnerability severity (CVSS and EPSS), ecosystem metadata and organization-specific criteria. More granular than the previous-generation firewall's plugin-based controls.
Catch known malicious packages before they are installed, cached or promoted internally. Uses dedicated malware databases, not just vulnerability feeds.
See exactly why a package was approved, blocked or approved by exception. Live logs show the package, version, rule, requester and timestamp. Developers and security teams read from the same log.
Grant a time-limited exception for a package that would otherwise be blocked. The exception is logged with the reason and expiry. Exceptions expire automatically without manual follow-up.
Manage firewall configuration and rules as code. Review changes in version control, roll back safely and deploy through existing automation.
Packages are scanned for malware, secrets and sensitive data before they are published to an upstream registry.
The next generation Dependency Firewall is a control point only. It sits in front of JFrog Artifactory, Sonatype Nexus, GitLab, Azure DevOps and other repository managers. It does not replace them.
Support for the most popular ecosystems from day one, with a model designed for broader coverage over time.
Managed SaaS hosted in the EU by default. Also runs in your own cloud account or in your data center. On-premise keeps every package request and decision log inside your network.
Works with the repositories you already use
Offer now
50% off your base fee for 3 months + €100 usage credit.
The two products share a name and a purpose. The architecture, policy model and capabilities are different.
Your price follows whichever you use most: active users, packages scanned or downloads served. The other two are included at the same plan size.
Enterprise dependency firewalls most often bill on several axes at once: a seat count, a scan count and a bandwidth line, each with its own overage. One team pays three times for being a single size measured three ways, and the invoice is hard to forecast.
Bytesafe measures all three meters and charges for the largest one only. The price per unit falls as you grow. Nothing throttles and nothing blocks when a month runs heavy: the plan sizes itself to the trailing 30 days and settles back as the spike ages out. Optional Cloud add-ons cover SSO/OIDC, container image firewall and Deep Scan. Enterprise plans agree limits in the contract.
See full pricingThe previous-generation Bytesafe reaches end of life on December 31, 2026. Existing customers can start evaluating the new generation now and migrate before that date. We provide a supported migration path and work through the transition with you based on your setup, ecosystems and repository architecture.
New customers
New customer onboarding focuses on the next generation Dependency Firewall. We are not onboarding new customers to the previous-generation firewall.
Book a demo to see it in action or get a walkthrough of how it fits your setup. Or start a free trial and set up your first policy.
Existing customers
You can keep using the previous-generation firewall while you prepare and test your migration. Both generations run at the same time, so you can validate the new firewall before production workloads switch.
If you use Bytesafe to store private packages, migration also includes moving those packages to a dedicated repository manager or private registry.
Questions from prospects, existing customers and teams evaluating the transition.
Talk to us about access, migration or how the new firewall fits with your repository architecture.
