# Bytesafe Docs

- Dependency Firewall
  - [Bytesafe Dependency Firewall](/firewall): Control which open source packages reach your builds. Documentation for the Bytesafe Dependency Firewall.
  - [Early access](/firewall/early-access): What to expect during the Dependency Firewall early access, how to give feedback, and known issues.
  - [Release notes](/firewall/release-notes): Product changes and additions to the Bytesafe Dependency Firewall.

  - **Getting started**
  - [What is a dependency firewall?](/firewall/getting-started/what-is-dependency-firewall): How the Bytesafe Dependency Firewall works, what it protects against, and where it fits next to SCA tools and repository managers.
  - [Quickstart](/firewall/getting-started/quickstart): Create a firewall, install a package through it, add a delay rule, create an exception, and read the logs. About ten minutes.
  - [Access Tokens](/firewall/getting-started/access-tokens): Personal Access Tokens (PAT), Service Access Tokens (SAT), and Trusted Builders with OpenID Connect (OIDC). Which one to use where, and how to create them.
  - [GitHub Actions](/firewall/getting-started/github-actions): Give GitHub Actions workflows firewall access without stored secrets. Register a Trusted Builder and exchange the workflow's OpenID Connect identity for a short-lived token.
  - [Config as code](/firewall/getting-started/config-as-code): Keep firewall configuration in git. Export it, change policy in a pull request, import it back, and roll back when needed.
  - Ecosystems
    - [All ecosystems](/firewall/ecosystems): Package ecosystems supported by the Bytesafe Dependency Firewall and how to point each client at your firewall.
    - [npm](/firewall/ecosystems/npm): Configure npm, yarn, pnpm, and Bun to install through your firewall. Registry setup, authentication, CI, publishing, and troubleshooting.
    - [PyPI](/firewall/ecosystems/pypi): Configure pip, uv, and Poetry to install through your firewall. Index setup, authentication, CI, publishing with twine, and troubleshooting.
    - [Maven](/firewall/ecosystems/maven): Configure Maven and Gradle to resolve dependencies through your firewall. Mirror setup, authentication, CI, publishing, and troubleshooting.
    - [NuGet](/firewall/ecosystems/nuget): Configure dotnet, nuget.exe, and Visual Studio to install through your firewall. Source setup, authentication, CI, publishing, and troubleshooting.
    - [Go](/firewall/ecosystems/go): Configure the Go toolchain to download modules through your firewall with GOPROXY. Authentication, the checksum database, CI, and troubleshooting.
    - [Conda](/firewall/ecosystems/conda): Point conda, mamba, or micromamba at your firewall as a channel. Authentication, metadata filtering, CI, and troubleshooting. Beta.
    - [Containers (OCI)](/firewall/ecosystems/containers): Container firewall for OCI registries, with vulnerability blocking, content scanning, rules, and pull logging.
  - How-to guides
    - [All how-to guides](/firewall/how-to): Every task guide for the Bytesafe Dependency Firewall, grouped by what you are trying to do.
    - [Block deprecated packages](/firewall/how-to/block-deprecated-packages): Keep versions out of your builds that their own publishers have deprecated, yanked, or unlisted.
    - [Block install scripts](/firewall/how-to/block-install-scripts): Match npm packages that declare install scripts and PyPI sdists that run code at build time, with the install-scripts selector function.
    - [Block malware](/firewall/how-to/block-malware): Evaluate downloaded and published package artifacts for malware findings and block at a chosen confidence level.
    - [Block packages by name, version, or source](/firewall/how-to/block-packages-by-name-version-or-source): Block packages by name, version, version range, upstream, or internal or external source.
    - [Block trust downgrades](/firewall/how-to/block-trust-downgrades): Block releases that use weaker publishing trust evidence than earlier releases of the same package.
    - [Block vulnerable packages](/firewall/how-to/block-vulnerable-packages): Block package downloads with known vulnerabilities above CVSS and EPSS thresholds.
    - [Configure upstreams](/firewall/how-to/configure-upstreams): Add, edit, and remove the registries a firewall fetches packages from, including private registries with credentials and a publish target.
    - [Delay new versions](/firewall/how-to/delay-new-versions): Add a delay rule that keeps newly published package versions out of your builds until they have aged.
    - [Enforce license policy](/firewall/how-to/enforce-license-policy): Block package downloads by license, with named license sets as deny or allow lists and a rule for unknown licenses.
    - [Integrate with repository managers](/firewall/how-to/integrate-repository-managers): Deploy the firewall together with Artifactory, Nexus, GitLab, GitHub Packages, Azure Artifacts, or AWS CodeArtifact, between them and the public registries, between developers and them, or on both sides.
    - [Investigate a blocked install](/firewall/how-to/investigate-blocked-install): Trace a failed install back to the firewall rule that caused it, and decide what to do about it.
    - [Manage access](/firewall/how-to/manage-access): Organize users into teams, set namespace permissions, and grant teams access to specific firewalls.
    - [Manage config as code](/firewall/how-to/manage-config-as-code): Run firewall policy from a git repository. Repository layout, review flow, applying from CI, drift detection, and rollback.
    - [Manage exceptions](/firewall/how-to/manage-exceptions): Create scoped, documented, expiring waivers when a rule blocks a package you need.
    - [Manage tokens](/firewall/how-to/manage-tokens): Create, scope, and revoke Personal and Service Access Tokens, and keep CI credentials short-lived with Trusted Builders.
    - [Manage upstream credentials](/firewall/how-to/manage-upstream-credentials): Set and rotate the credentials a firewall uses against private upstreams, or supply them just-in-time per request.
    - [Migrate from previous-generation Bytesafe](/firewall/how-to/migrate-from-previous-generation): Move from Bytesafe hosted registries, policies, and plugins to the Dependency Firewall, with private packages in a repository manager and policy as rules.
    - [Prevent dependency confusion](/firewall/how-to/prevent-dependency-confusion): Stop public registries from serving packages that share names with your internal packages.
    - [Receive webhook events](/firewall/how-to/receive-webhook-events): Push firewall, audit, configuration, and publish events to your own systems as signed, batched webhook deliveries.
    - [Review the audit log](/firewall/how-to/review-audit-log): Trace who changed firewall configuration, policy, tokens, and teams, and spot denied or failed attempts.
    - [Scan for secrets on publish](/firewall/how-to/scan-for-secrets): Block publishes of packages that contain leaked credentials, scanned on the upload phase.
    - [Share configuration across firewalls](/firewall/how-to/share-configuration-across-firewalls): Let firewalls inherit rules, exceptions, and upstreams from a baseline firewall, so one policy change applies across the organization.
    - [View logs](/firewall/how-to/view-logs): Read firewall logs in the dashboard and stream them live from the terminal with the bsfw CLI.
  - Concepts
    - [All concepts](/firewall/concepts): The mental models behind the Bytesafe Dependency Firewall, prevention, rules, upstreams, exceptions, access, observability, and deployment.
    - [Access and permissions](/firewall/concepts/access-and-permissions): How namespaces, teams, per-firewall grants, and token scopes combine into effective permissions.
    - [Deployment models](/firewall/concepts/deployment-models): The two ways to run the Bytesafe Dependency Firewall, SaaS or self-hosted on your own infrastructure, and what changes between them.
    - [Exception model](/firewall/concepts/exception-model): Why waivers in the firewall are scoped to one rule, carry a reason, and expire on their own.
    - [Execution phases](/firewall/concepts/execution-phases): What each execution phase sees during an install, and why filtering versions keeps builds running while download rules are the hard stop.
    - [Observability](/firewall/concepts/observability): The four records a firewall keeps, firewall log, audit log, metrics, and observations, and which question each one answers.
    - [Prevention model](/firewall/concepts/prevention-model): The preventive control model. How a dependency firewall differs from scanners and from repository managers.
    - [Rule evaluation](/firewall/concepts/rule-evaluation): The mental model behind firewall rules. Execution phases, selectors, effects, and where exceptions fit in.
    - [Upstreams and caching](/firewall/concepts/upstreams-and-caching): How a firewall resolves packages from multiple registries, why internal upstreams win, and what the cache flag does.
  - References
    - [All references](/firewall/references): Exhaustive lookup for the Bytesafe Dependency Firewall, config, rules, access, and observability.
    - [Advisory sources](/firewall/references/advisory-sources): Advisory and exploit-prediction data used by the vulnerabilities selector function.
    - [API](/firewall/references/api): The management API under /v1/<namespace-id>. Endpoints for configuration, rules, exceptions, logs, metrics, observations, audit, webhooks, tokens, teams, and Trusted Builders.
    - [Audit log](/firewall/references/audit-log): Field-level reference for audit events, the action catalog, and the query API.
    - [CLI](/firewall/references/cli): Install and configure bsfw. Commands, profiles, authentication, flags, environment variables, output formats, and exit codes.
    - [Exceptions](/firewall/references/exceptions): Field-level reference for firewall rule exceptions and the exception reason vocabulary.
    - [Firewall config](/firewall/references/firewall-config): Field-level reference for the firewall configuration object, the unit that config export and import operate on.
    - [Logs](/firewall/references/logs): Field-level reference for firewall log entries and the query and streaming API.
    - [Metrics](/firewall/references/metrics): Reference for the traffic and enforcement counters, per namespace and per firewall.
    - [Observations](/firewall/references/observations): Reference for package observations, the traffic-derived inventory of which package versions are in use.
    - [Permissions](/firewall/references/permissions): The full permission catalog, the built-in team permission sets, and the defaults applied to new firewalls.
    - [Rules and selectors](/firewall/references/rules-and-selectors): Field-level reference for firewall rules, selectors, selector functions, effects, and exceptions.
    - [Selector functions](/firewall/references/selector-functions): Reference for the named selector functions, including vulnerabilities, vulnerability fixes, malware, install scripts, package status, licenses, secrets, and publishing trust.
    - [Tokens](/firewall/references/tokens): Token types, prefixes, lifetimes, scope claims, the interaction ID suffix, and the credential envelope format.
    - [Upstreams](/firewall/references/upstreams): Field-level reference for upstream configuration, credentials handling, and cache behavior.
    - [Webhooks](/firewall/references/webhooks): Field-level reference for webhook event types, the delivery envelope, Standard Webhooks signing, delivery and retry behavior, and delivery records.
  - Security & platform
    - [Security & platform](/firewall/platform): How the Bytesafe-operated SaaS authenticates people and what surrounds that.
    - [Authentication](/firewall/platform/authentication): How you sign in to Bytesafe, the sign-in methods available, and how an organization connects its own identity provider for single sign-on.

  - **More**
  - [Free for open source](/firewall/open-source): Free, sponsored access to the Bytesafe Dependency Firewall for public open source projects.
  - [Self-hosted](/firewall/self-hosted): Self-hosted (on-premises) availability for the Bytesafe Dependency Firewall.
  - [Support](/firewall/support): How to reach Bytesafe support, and answers to frequently asked questions.
  - [Book a demo](https://calendly.com/bytesafe/bytesafe-sbom-observer-discovery-call)