Cloudsmith announces new features for enforcing software supply chain governance in artifact repositories. August 17, 2026 Cloudsmith announced an expansion to its policy management and continuous risk detection capabilities, adding policy templates, cooldown policies, and expanded evaluation triggers. The new features continue to strengthen the artifact repository as the most critical point of control for securing the software supply chain and providing proactive protection for developers. Select customers have been testing the new features and reporting significant benefits, especially from new cooldown and malicious package policies. Attacks increasingly target pipelines and open source packages, so one misconfigured pipeline can result in an incident. Since Cloudsmith policies apply company-wide at the repository level, the risk of a misconfigured pipeline is greatly reduced. Cloudsmith reduces time to policy enforcement, minimizes friction for developers, and ensures policy changes take effect immediately across repositories. New features being announced today include: - Policy templates: pre-configured policies as code, written in the Rego language, to jump-start a set of recommended baseline controls to begin enforcement immediately. - Cooldown policies: Highly configurable cooldown policies that apply across repositories, teams, and formats. Cloudsmith cooldown policies work by creating a filtered view of upstream public registry package indexes, so that each developer or CI/CD pipeline's package managers see only versions that meet policy and thus default to the latest compliant version automatically. This prevents build failures and eliminates the need to revise dependency files. - Expanded evaluation triggers: In addition to evaluating on package upload and when threat intelligence updates, Cloudsmith policies now also evaluate when a policy is created or updated, without the need for a manual backfill step. Together, these capabilities strengthen Cloudsmith's role as a comprehensive, centrally-managed control plane for the software supply chain. Alison Sickelka, Cloudsmith's VP of Product, said "We created our policy management feature set because we believe the artifact registry is the right place to enforce control of the software supply chain. It's one of our most quickly adopted feature sets ever, especially for cooldown and malicious package policies. Security teams need better ways to react, and they need to stop unsafe software at the boundary of their environment, before unwanted packages can reach developers or pipelines. Today's updates give organizations an even stronger enforcement point across every team, every pipeline, and every package format." Industry news. August 17, 2026 The Cloud Native Computing Foundation(R)(CNCF(R), which builds sustainable ecosystems for cloud native software, announced the graduation of Kubeflow, a cloud native ecosystem forged by an open community dedicated to standardizing Data & AI workloads on Kubernetes. August 17, 2026 Google's Agent2Agent Protocol (A2A) is joining the Agentic AI Foundation (AAIF). August 17, 2026 Cloudsmith announced an expansion to its policy management and continuous risk detection capabilities, adding policy templates, cooldown policies, and expanded evaluation triggers. August 13, 2026 The Linux Foundation, the nonprofit organization enabling mass innovation through open source, announced the schedule for Open Source Summit + Embedded Linux Conference Europe 2026, taking place in Prague, Czechia from October 7-9. August 12, 2026 The Cloud Native Computing Foundation(R)(CNCF(R), which builds sustainable ecosystems for cloud native software, announced the graduation of Cloud Native Buildpacks, an open source project that builds OCI-compliant container images directly from application source code. August 12, 2026 Quali announced the general availability of Stack Automation, a deployment automation platform developed in collaboration with Cisco and available exclusively through Cisco, built to bring enterprise-grade speed, governance, and agentic AI capability to every layer of the infrastructure stack. August 12, 2026 CodeRabbit introduced Agentic Change Management - the control layer that enables teams to govern, understand, and ship software created by people and agents. August 11, 2026 Citrix announced new services for Citrix(R) Platform Flex, including Citrix SecurSpaces(TM) Flex, a hosted, cloud-based platform for code development and agentic workloads that allows enterprises to provide secure environments without building and operating the platform themselves. August 11, 2026 Semgrep announced a deepened partnership with Replit to bring automated, real-time security analysis directly into the AI-native development workflow. August 10, 2026 The CNCF announced the full schedule for KubeCon + CloudNativeCon North America 2026, taking place November 9-12 in Salt Lake City, Utah. August 06, 2026 Apiiro has joined Athena, the Chainguard-led coalition to protect open source software from AI attacks. August 05, 2026 The CNCF Technical Oversight Committee (TOC) has voted to accept Kubernetes Global Balancer (K8gb) as a CNCF incubating project. August 05, 2026 Red Hat announced the formation of asago, an open source community project intended to automate how AI governance policies become product-ready, safely-deployed AI systems. August 05, 2026 Checksum launched the Continuous Quality Loop, connecting test generation, execution, and maintenance directly into GitHub, CI pipelines, and MCP so tests run the moment a pull request opens.

Cloudsmith credentials are now detectable by GitHub Secret Scanning. Jun 18 2026 Leaked API keys are one of the most common and well-understood security failures in software development. A credential committed to a repo, copied into a script, or exposed in a CI log can sit undetected until abuse makes it visible. By then, the damage is done. Cloudsmith is now a member of the GitHub Secret Scanning Partner Program. That means Cloudsmith-issued API keys are uniquely identifiable, and GitHub can detect them automatically when they appear in a repository. How it works. Cloudsmith issues API keys with a unique prefix. That prefix is registered with GitHub's secret scanning infrastructure, so when a Cloudsmith credential appears in a repo - in source code, a config file, a committed .env, or anywhere else GitHub indexes - GitHub detects and flags those credentials automatically. When a leak happens, Cloudsmith notifies the affected customer directly. Teams can revoke or rotate the compromised key before it gets misused. The workflow is straightforward: detection happens automatically, notification is immediate, and your team decides how to respond. Why this matters for your team. The window between a credential leak and credential abuse is short and it closes fast. Automated scanners can pick up a key exposed in a pull request or pushed to a public repo within minutes. Discovering issues through billing anomalies or abuse reports put teams in a challenging position, and one they want to avoid. Automatic detection of leaked API keys changes that dynamic. When exposure triggers an immediate notification, the response begins before most incidents have a chance to develop. This works inside the workflows your team already uses. There is no new tooling to adopt, or new configuration required on your end. GitHub-based teams get detection in place from the moment they issue their next Cloudsmith API key. Read more by