More flexible rules
Build rules on package name, version range, age, license, vulnerability score (CVSS and EPSS), upstream and other package properties. Conditions combine.
Moving to the new Bytesafe Dependency Firewall
If you use the previous-generation Bytesafe, this page is for you. The new Dependency Firewall is open for evaluation, and we are starting to move customers across.
Everything you need to plan and run the migration is on this page. Start evaluating now, well ahead of the end-of-life date.
End of life
December 31, 2026
Previous-generation Bytesafe
This date does not apply to the new Dependency Firewall.
- Early access
- Sign up
- Evaluation and migration
- No additional cost
- Existing customer offer
- 50% off, 3 months
A firewall enforcement layer instead of a package repository
The previous generation combines dependency security with a hosted package repository. The new generation separates them: Bytesafe enforces policy on every package request, and your packages are stored by your repository manager or the upstream registry. That separation is what makes the new capabilities possible.
Previous generation
Developers / CI
Bytesafe registries with policies
Public registry
Packages are stored in Bytesafe. Policies and plugins control what can be used.
New generation
Developers / CI
Bytesafe Dependency Firewall
Public registry
Your repository manager
The firewall checks every request against your firewall rules and exceptions. Private packages are stored in your repository manager.
How much work the migration is depends on where your packages live today.
Only public packages: nothing to move. Set up your firewalls and rules, then point your package managers at them.
A repository manager you already run: it keeps storing your packages while Bytesafe enforces policy. JFrog Artifactory, Sonatype Nexus, GitHub Packages, GitLab, Azure Artifacts and AWS CodeArtifact all work.
Private packages stored in Bytesafe: those packages need to be moved to a dedicated package repository.
What is better in the new Dependency Firewall
A redesigned policy and enforcement model, plus capabilities the previous-generation firewall does not have.
Malware protection
Block known malicious packages before they reach a developer machine or a CI/CD pipeline.
Clear decision logs
Every request is logged: the package, the version, the rule that made the decision and who asked for it.
Time-limited exceptions
Let a blocked package through with a documented exception. Set an expiry and the exception lifts itself.
Policy as code
Configure everything in the dashboard, or take the same configuration as JSON through the API and CLI, keep it in version control and review policy changes like code.
Publish protection
Packages are inspected for malware, secrets and sensitive data before they are published to an upstream registry.
Predictable pricing
Most existing customers should pay about the same or less. We can confirm your expected price before you migrate.
One plan, based on what you use most
Your plan is based on whichever is highest: active users, packages scanned or downloads served. The other two are included.
Any exceptions are clear before you migrate
A few customers may pay more because of higher usage or Enterprise requirements. We will review your setup and confirm your price before you move.
Existing-customer migration offer
Base fee and usage, first 3 months after migration
50%off
No double payment. Your offer starts when your previous-generation subscription closes and the new one begins.
How to get started
Nothing switches at once. Both generations run at the same time while you set up and test the new firewall, so you move at your own pace. Evaluating and migrating come at no additional cost.
- 1
Start a trial account
Sign up yourself, no approval needed. Trials start at 14 days, and we automatically extend them for existing customers to cover the full evaluation and migration period at no additional cost. Set up a firewall, point one project or CI/CD pipeline at it, and compare what it allows and blocks against your existing setup.
- 2
Migrate at your own pace
Recreate policies as rules, connect a repository manager and move private packages. Your current setup keeps working until you point traffic away from it, and nothing is switched off on our side before the end-of-life date.
- 3
Tell us when to start your discount
After you migrate, tell us when your offer should start. We close your previous-generation subscription and apply 50% off your new invoice, base fee and usage, for the first 3 months after migration, so you never pay for both.
Documentation and guides
Dependency Firewall documentation
How the new firewall works, how to configure rules and exceptions, connect package ecosystems and integrate with your environment.
Explore the documentationMigration guide
The detailed process for moving registries, private packages, policies and plugins from the previous generation.
Read the migration guideWe are here to help
Every setup is different. Ask us about your migration plan, repository architecture, moving private packages, recreating existing policies, pricing or how the new Dependency Firewall fits your environment.
Common questions
When does the previous-generation Bytesafe reach end of life?
The previous-generation firewall reaches end of life on December 31, 2026. Start your evaluation and migration planning ahead of that date so you have time to test the new setup before production workloads switch.
Do we need to migrate immediately?
Both generations run at the same time during the migration, so you can evaluate the new Dependency Firewall and move once your new setup is ready. Plan the migration early: recreating rules, connecting a repository manager and moving private packages are all part of it, and the work needs to be done before December 31, 2026.
Do we pay for both generations while we migrate?
No. Evaluating and migrating come at no additional cost: you keep paying your previous-generation subscription and nothing else. When you switch, we close it and start your offer on the new firewall.
When does the migration offer start?
When you tell us. After you migrate, let us know when you would like the offer to begin. We close your previous-generation subscription and apply 50% off your new invoice, base fee and usage, for the first 3 months after migration.
Is the new Dependency Firewall also a package repository?
No. The new generation is an enforcement layer. It checks package requests and applies your rules. It does not store or serve your packages.
Do we need a repository manager?
Only for private packages. If you consume packages from public registries only, your package managers can talk to the Dependency Firewall directly. Private packages belong in a repository manager or private package registry.
What happens to private packages stored in Bytesafe today?
You move them to a dedicated package repository as part of the migration. Bytesafe has a push feature for this: push all packages in a registry, every version of one package, or a single version straight to your new upstream. The migration guide covers how to move them and validate the new setup before you switch.
How does pricing work on the new firewall?
Cloud pricing follows whichever of three measures you use most: active users, distinct package versions scanned or downloads served. The highest one determines your plan size, and the other two are included at the same size. You are not charged separately for all three. See the full pricing page for plan ranges, worked examples and add-ons.
Will our pricing change?
The model changes, but for most existing customers comparable usage should result in a similar monthly price or a lower one. Some customers may pay more when one usage measure is materially higher, or when Enterprise deployment, support or commercial terms are required. Read the pricing overview above and see the full pricing page, or ask us to confirm your expected price before you move. Every existing customer also gets 50% off the entire invoice, base fee and usage, for the first 3 months after migration.
Can Bytesafe help us with the migration?
Yes. We review your current setup, work through your repository architecture, plan the migration with you and answer technical or commercial questions about the new firewall.
Ready to start planning your migration?
Start a trial now, evaluate and migrate at no additional cost, and get 50% off the entire invoice, base fee and usage, for the first 3 months after migration. Contact us if you would like to review the migration together first.