Cloudsmith gives us one controlled front door for every package our engineers consume. We host our private packages and proxy/cache public upstreams through it, so builds don't break when a public registry has an outage, and we can see and govern exactly which open-source components enter our software. Vulnerability scanning and license policies turn supply-chain security from a manual review exercise into something enforced automatically at the registry. As the person accountable for both engineering and compliance, that combination is rare. Review collected by and hosted on G2.com.
Pricing scales with usage and storage, so it's worth planning retention and cleanup policies early rather than letting old artifacts accumulate. That said, the ROI versus running and securing our own registry infrastructure is clear. Review collected by and hosted on G2.com.
We're delighted to hear how much value you're getting from Cloudsmith. We want customers to see Cloudsmith as the system of record for binary artifacts and the whole software supply chain. Once you've got that, you can confidently implement security & compliance controls. Thanks for the review, Philip! - Glenn Weinstein, CEO