Advanced controls

Tokens expire after 30 days. Publish tokens are namespace-bound and cannot manage accounts or approve releases. Read tokens access private catalog and signed downloads. Tokens are shown only once.

Your namespaces

Invitations for you

Only members of the matching publisher namespace can submit. The package identity must match its manifest.

Rejected or revoked versions can be appealed once at a time. A correction to package contents must be submitted as a new version and reviewed separately.

Queue operations

Stale scans are claims older than ten minutes. A recent heartbeat means a worker reached the database within fifteen seconds, not that every scan is healthy.

Queue health not loaded.

Signing backlog not loaded.

Signed metadata expiry not loaded.

Review the exact digest and scan result before making a decision. Automated scanning is not a security guarantee.

Open appeals

Revocation immediately removes a version from the public API. Enter a clear reason before revoking.

Block an exact SHA-256 package or file digest. Matching approved versions are revoked immediately. Publish updated signed TUF metadata promptly so desktop clients receive authenticated revocation. A false positive requires an audited removal; it does not automatically restore revoked versions.

Import a vetted hash list

Enter one lowercase SHA-256 digest and its reason per line, separated by a space or tab. Review the source before importing. All entries succeed together, or none are saved. Up to 100 entries are allowed.

Only mark a namespace verified after checking independent proof of ownership. Every change is audited.