Skip to content
Ravenstash
Create account

Private by default, from sign-in to install.

Ravenstash protects package publishing, installs, storage, and dashboard actions with clear access controls built for individual developers and organizations.

Create accountRead the account security docs
  1. 01Your packages
  2. 02Your account
  3. 03Who can access what
  4. 04Credentials
  5. 05Your data

01 · Your packages

Spot risk before your team depends on it.

Protection checks PyPI, npm, and Maven package versions for known vulnerabilities, malware, suspicious code, unsafe archive content, and other risks. Checks run in the background and never execute package code.

Every finding, with the evidence behind it

Each package version gets one assessment: what was found, how serious it is, which dependency it comes from, and the version that fixes it.

  • Known exploited. Vulnerabilities attackers are known to exploit are marked and rank above Critical.
  • Known vulnerabilities. See affected versions, severity, and available fixes in one place.
  • Secret indicators. Catch credentials and sensitive values accidentally shipped in a package.
  • Malware signals. Identify known malicious content before it enters your software supply chain.
  • Suspicious install behavior. Surface unusual scripts and risky package behavior for review.
Read how Protection works

Example assessment

com.acme:billing-service3.2.0

Quarantined

3 findings · 1 known exploited · can't be installed until released

  • CVE-2021-44228 in log4j-core

    CriticalKnown exploited

    Reached the quarantine threshold (Known exploited)

    pkg:maven/org.apache.logging.log4j/[email protected]Fixed in 2.15.0

    Upgrade log4j-core from 2.14.1 to 2.15.0 or later.

    Rule or advisory
    GHSA-jfh8-c2jp-5v3q
    Aliases
    CVE-2021-44228
    Affected package
    log4j-core 2.14.1
    CVSS
    10.0
    Fixed versions
    2.15.0
    Known exploited
    Yes

  • Secret found

    High

    Reached the flag threshold (High)

    Found in config/application.properties

  • Static code issue found

    Medium

    Found in com/acme/billing/Loader.class

Flag what needs a look. Quarantine what must not ship.

Each package format in a repository has its own policy with two thresholds on one risk scale. A version is flagged when its highest finding reaches the first and quarantined automatically when it reaches the second. Every repository starts with Balanced protection.

Choose a policy
  1. LowReported
  2. MediumReported
  3. HighFlagged
  4. CriticalFlagged
  5. Known exploitedFlagged
  6. Suspected maliciousFlagged
  7. Known malwareAlways blocked

Observe. Flags High and above for review. Never changes availability.

  1. LowReported
  2. MediumReported
  3. HighFlagged
  4. CriticalQuarantined
  5. Known exploitedQuarantined
  6. Suspected maliciousQuarantined
  7. Known malwareAlways blocked

Balanced protection. Flags High and above for review. Quarantines Critical and above.

  1. LowReported
  2. MediumFlagged
  3. HighQuarantined
  4. CriticalQuarantined
  5. Known exploitedQuarantined
  6. Suspected maliciousQuarantined
  7. Known malwareAlways blocked

Strong protection. Flags Medium and above for review. Quarantines High and above. Quarantines versions whose checks fail.

  1. LowFlagged
  2. MediumQuarantined
  3. HighQuarantined
  4. CriticalQuarantined
  5. Known exploitedQuarantined
  6. Suspected maliciousQuarantined
  7. Known malwareAlways blocked

Strict intake. Flags Low and above for review. Quarantines Medium and above. Holds new versions until checks finish and quarantines versions whose checks fail.

  • Reported. Shown as findings. Availability doesn't change.
  • Flagged. Flagged for review. Versions stay available.
  • Quarantined. Can't be installed until released.
  • Always blocked. Known malware, in every repository.

  • Release a version

    Release a quarantined version once you have reviewed it. The findings accepted at release stop counting toward the thresholds.

  • Allow a finding

    Allow findings that don't apply to you, so they no longer flag or quarantine versions.

  • Quarantine by hand

    Policies act automatically, and you can still quarantine or release any version yourself.

The same care for public dependencies

Put PyPI, npmjs.org, and Maven Central behind a private mirror so what your builds pull in passes through one protected path.

See private mirrors
  • Private packages and mirrored dependencies are scanned for malware and known security risks before they enter trusted build workflows.
  • Minimum package age can delay brand-new upstream releases during the riskiest hours after publication.
  • Private mirrors keep public and authenticated external sources behind one protected path.
  • Known malware is blocked automatically. Your teams stay protected without another manual step.

02 · Your account

Measured by the weakest way in.

See your protection level at a glance and know exactly what to strengthen next.

  • Keep one-time recovery codes offline for a lost device or unavailable authenticator.
  • Important account changes ask for a fresh confirmation with a method already connected to the account.
  • Developers sign in to the rvs CLI through the browser and can revoke active device sessions from the dashboard.
Understand account protection

  1. Tier 1 · Lowest protection

    Needs protection

    No second verification step has been set. Your account is at risk.

  2. Tier 2 · Provider managed

    Protected by your linked account

    The weakest sign-in relies on the security configured in Google or GitHub.

  3. Tier 3 · Fully enforced

    Two-step verification fully enforced

    Every enabled sign-in method is protected by another verification step.

  4. Tier 4 · Advanced

    Passwordless passkeys protection

    A phishing-resistant passkey-only stance with a higher recovery responsibility.

03 · Who can access what

Know who can access what, and why.

Give people the access their work requires, then review every member's effective access from one clear view.

  • Private repositories require approved access for publishing, installs, and browser downloads.
  • Organization admins manage members, invitations, Teams, and organization-wide access.
  • Namespace admins manage their namespace, Teams, and repositories, without broader organization authority.
See organizations and namespaces

Member access

Why can Alex access this repository?

  • Platform team

    Team role for shared development work

  • Direct grant

    Publisher on this repository, granted to Alex

  • Effective access

    One explainable view of every permission source

04 · Credentials

Keep powerful credentials out of package tools.

Developers sign in securely through their browser. Automation gets fine-grained access. Package tools receive a short-lived token for the task at hand.

  • Teams can use organization automation tokens for CI instead of tying builds to one developer account.
  • Organization access and separate automation tokens keep human and build-system access independent.
  • Browser package downloads use short-lived access links for the current download action.
Read the credential model
  1. 1

    Trusted identity

    Browser or automation login

    Use secure CLI device login or a fine-grained automation token.

  2. 2

    Right-sized access

    Only what is needed

    Ravenstash limits access to the repository and action being requested.

  3. 3

    Package tool

    Short-lived registry token

    Your package client receives a temporary token, not your main credential.

  • Fine-grained access
  • One repository
  • Read or publish
  • Short expiry
  • Easy to revoke

Your main credential stays with Ravenstash CLI. Package tools receive only a short-lived token with limited access.

05 · Your data

Know where your package files live.

Choose where package files are stored at rest, keep them in storage you own, and see how they are used.

See artifact storage

Report a security issue

For the rvs CLI, use GitHub private vulnerability reporting. For the hosted service, email [email protected]. Please leave out real credentials, tokens, and private package contents.

  • EU storage

    Organizations can keep package data at rest inside the EU for GDPR compliance.

  • Customer-owned storage

    Package files can remain in Cloudflare R2 or OVH Object Storage controlled by the customer.

  • Deletion with a recovery window

    Deleting a repository cuts off package access immediately while keeping a short recovery window.

  • Usage you can see

    Repository, package, download, and storage views help teams see how packages are being used.

Free to start

Start with security already in place.

Create an account, turn on two-step verification, and publish to a private repository.

Create accountRead the account security docs