SONATYPE LIFECYCLE

Control open source risk across your SDLC

Automatically find and fix open source vulnerabilities across the SDLC.

Scan an Application

Try it On Cloud

ENTERPRISE SECURITY

Monitor

Get alerts of new vulnerabilities based on risk level and applications affected.

Remediate

Improve incident response times with precise identification and vulnerability location.

Scale

Reduce manual compliance checks by enforcing customizable policies automatically.

Empower

Give developers the tools they need to choose healthier open source components.

“Using Sonatype Lifecycle, we’re able to identify risks earlier than ever before in the development process — especially compared to six months ago. Sonatype Lifecycle works very well within our DevOps practice.”

PREM RANGANATH

VP of Quality and Risk Management, Trilliant

Control risk without switching tools

Choose healthier components right from your IDE or source control, as easy as adding packages.

Code quality from the start

Prevent unplanned work, security breaches, and maintainability issues with early detection and remediation.

Remediate vulnerabilities fast

Know the exact location of any component and their dependencies. Get precise intelligence to fix threats fast.

“We selected Sonatype Lifecycle because it has a very, very detailed explanation of the open source vulnerabilities and dependencies compared to other products."

Ufuk Tankurt

Chief Architect, KKB

Monitor for open source risk

Receive ongoing monitoring and alerts of new vulnerabilities based on component, risk level, or applications affected.

Enforce policy automatically

Customize policies to meet specific compliance goals and ensure they are enforced across a variety of development tools, without sacrificing speed.

Generate a Software Bill of Materials

Gain full visibility in minutes for each application for quick remediation of vulnerabilities based on detailed intelligence.

“Automated monitoring is the primary reason we chose Sonatype Lifecycle. It alleviates the time consuming manual processes that inhibit scaling. We want to be able to have our eyes on the code and have Sonatype Lifecycle tell us when there’s something requiring our attention.”

DAVID BLEVINS

CEO, Tomitribe

Run products anywhere

Flexible deployment options let you run anywhere—without the operational hurdles. Deploy easily with world class support from our Technical Support team at no additional cost.

Cloud

Get started right away. Streamline your infrastructure and rapidly scale with cloud solutions hosted on AWS and managed by Sonatype.

Available for

Learn More

Self Hosted

Unlock maximum flexibility. Choose to host on your own servers or in a cloud environment of choice.

Available for

Learn More

Air-Gapped

Adhere to the strictest security standards for government and affiliated organizations. Sonatype offers the only software supply chain solution for air-gapped environments.

Available for

Learn More

Lifecycle tool integrations

Azure DevOps

Use Sonatype to store and manage binaries, build artifacts, and Docker containers within your OpenShift environment.

Works With

Jenkins

Use Sonatype to store and manage binaries, build artifacts, and Docker containers within your OpenShift environment.

Works With

Atlassian Bamboo

Use Sonatype to store and manage binaries, build artifacts, and Docker containers within your OpenShift environment.

Works With

Chrome Extension

Identify the risk within a package before you even download it with our Chrome extension.

Works With

Ahab

Scan base OS (debian, fedora, alpine) packages for vulnerabilities.

Works With

Nancy

Scan Golang projects for vulnerable third party dependencies.

Works With

Eclipse

Empower developers with precise component intelligence directly within the Eclipse IDE.

Works With

IntelliJ IDEA

Empower developers with precise component intelligence directly within IntelliJ IDEA.

Works With

Microsoft Visual Studio

Empower developers with precise component intelligence directly within Microsoft Visual Studio.

Works With

Github

Sonatype Lifecycle pushes component intelligence into GitHub where developers can view and respond to policy violations directly in pull requests.

Works With

Gitlab

Sonatype Lifecycle pushes component intelligence into GitLab where developers can view and respond to policy violations without breaking a build.

Works With

Atlassian Bitbucket

Sonatype Lifecycle pushes component intelligence into Bitbucket where developers can view and remediate policy violations with detailed Code Insights.

Works With

Maven

Infuse your Maven builds with the most precise component intelligence and automatically fail builds based on policy violations, including violations found in transitive dependencies.

Works With

Gradle

Resolve dependencies and deploy your artifacts and build information to Sonatype Nexus Repository Manager.

Works With

Jira

Auto-create Jira tickets when policy violations are triggered in Sonatype Lifecycle.

Works With

Slack

Communicate policy results to stakeholders via Slack.

Works With

Micro Focus Fortify

Gain a 360-degree view of all your application security issues with integration to Fortify SSC and Fortify On-Demand.

Works With

Threadfix

View Sonatype Lifecycle data in the ThreadFix dashboard for a single view of application security issues.

Works With

Kenna

View open source risk and policy violations with the Kenna security dashboard.

Works With

Docker

Automate container security and scale DevOps with Lifecycle container analysis.

Works With

Red Hat Clair

Sonatype Lifecycle integrates with Red Hat Clair to evaluate application, runtime, and OS level vulnerabilities within IQ for a single view into container risk.

Works With

DockerHub

Configure a DockerHub webhook listener that will consume events, and perform an IQ Lifecycle scan.

Works With

OpenShift

Use Sonatype to store and manage binaries, build artifacts, and Docker containers within your OpenShift environment.

Works With

Amazon Web Services

Manage and secure open source and third-party components in the cloud with Sonatype Nexus Repository and IQ Server.

Works With

Lifecycle language support

Java

Javascript

Python

Ruby

Scala

Swift

Clojure

Gosu

PHP

See All Language Support

Lifecycle package support

Maven

npm

Docker

PyPi

Nuget

Yum

Rubygems

Apt

Helm

gitlfs

Conan

See All Package Support

“We wanted fast solutions, but also wanted those to be secure solutions. With Lifecycle, we can help programmers make the right decisions and make their software more secure. That's why we chose Sonatype Lifecycle.”

Stefan Simenon

Head of Centre of Expertise of Software Development & Tooling, ABN-AMRO