Operations | Monitoring | ITSM | DevOps | Cloud

Code review has always been a time sink. AI just makes the dysfunction undeniable. Luca Rossi, founder of Refactoring.fm and builder of the open source tool Tolaria, has been running one of engineering's most-read newsletters for five years, with over 170,000 subscribers. He's also been doing what a lot of engineering leaders talk about but rarely do: building a real product with AI agents to pressure-test what's actually possible today.

Asking developers to take extra steps to pull securely is a policy that won't hold. The only approach that scales is making the private registry the default – a buffer between the developer and public registries that applies policy automatically at the global level. No extra steps, no security theater, no cognitive overhead at the point of pull. Automation and global policy configuration are what turn good intentions into a default secure posture.

For years, buying software meant trusting the vendor. The Cyber Resilience Act changes that relationship by codifying what vendors must do – auditing dependencies, confirming exploitable vulnerabilities, and enforcing security best practices – as legal obligations, not internal choices. For customers, that means software safety is no longer a matter of brand reputation. For vendors, it means governance gaps that were once internal concerns are now deal blockers.

Vulnerability scanners tell you what's wrong with what you already pulled. They don't stop a malicious package from entering your environment in the first place. A private registry with minimum release age policies adds that missing layer – packages newer than two or three days don't reach developers until the industry has had time to identify and remove malicious ones from public registries. Active campaigns like TeamPCP are targeting npm, PyPI, and Maven Central right now. The gate has to come before the scan. Cloudsmith provides that gate.