Snapshot 257814
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Security You Can Trust Trust is foundational to the success of our business. Trust = Transparency + Accountability. We strive for transparency through clear communication across functions and levels. We hold ourselves accountable for the promise we make to our employees, investors, and customers. To earn your trust, we share our security and compliance programs with you. We continuously evolve with the ever-changing world around us to safely manage the confidentiality, integrity, and availability of not only Sonatype's but also the customers' data and services that we manage. Security at SonatypeOpens in new tab | Bug Bounty ProgramOpens in new tab | Security AdvisoriesOpens in new tab security@sonatype.com Privacy PolicyOpens in new tab AWS Marketplace listingOpens in new tab Filter by Compliance SOC 2 ISO 27001:2022 NIST CSF 2.0 Resources View all Security Compliance & Assurance SOC 2 Type II Report DHS CISA Secure Software Attestation Sonatype SOC 2 Bridge Letter Security Policies Acceptable Use Policy Business Continuity and Disaster Recovery Policy Change Management Policy AI Acceptable Use Policy View 10 more Independent Security Assessment Maven Central Sonatype Nexus Repository Sonatype Lifecycle & Firewall (EU) Sonatype Lifecycle (Private Cloud) View 4 more Accessibility Compliance Lifecycle INT VPAT Nexus Repository VPAT Nexus Firewall VPAT Sonatype Guide VPAT Other resources Information Security Management Program Auditing Policy Sonatype Statement of Applicability ISO 27001:2022 Updates View all Security eMudhra certificate incident and PHP2Shell Published October 21, 2026 Sonatype is tracking the eMudhra certificate authority incident and PHP2Shell vulnerabilities (CVE-2026-109618 and CVE-2026-109619). Sonatype products are not affected by PHP2Shell. We are updating our products to address the eMudhra certificate issue and will publish guidance as updated versions become available. Customers should promptly update browsers, operating systems, certificate trust stores, and software that bundles a trust store. If you use eMudhra-issued certificates, contact your certificate provider to confirm whether your certificate chain is affected. Do not bypass certificate validation warnings. If your organization operates PHP applications or services, identify affected versions, prioritize internet-facing systems, and apply the fixed release or vendor patch as soon as possible. Check products and appliances that bundle PHP. Temporary mitigations are not a substitute for patching. For updates, visit the Sonatype Security Events guideOpens in new tab, eMudhra guidanceOpens in new tab, and PHP2Shell guidanceOpens in new tab. Also follow eMudhra’s incident updatesOpens in new tab, official PHP security announcementsOpens in new tab, and advisories from your vendors and maintainers. Compliance SOC2 Type II report Published August 11, 2026 Lastest SOC2 Type II report for 2025 - 2026 now available. Controls View all Infrastructure security Remote access encrypted enforced Organizational security Code of Conduct acknowledged by employees and enforced Security awareness training implemented Product security Control self-assessments conducted Vulnerability and system monitoring procedures established Penetration testing performed Internal security procedures Continuity and Disaster Recovery plans established Development lifecycle established Management roles and responsibilities defined View 12 more Internal security procedures controls Data and privacy Data retention procedures established Data classification policy established FAQ View all Media View all Software Supply Chain Management is Sonatype Opens in new tab Sonatype has been researching, studying and pioneering software supply chains for almost 15 years. And our deep investment in this field has allowed us to experience and understand the many trends that have shaped its direction. Software supply chain management has been a lot of things including difficult and time-consuming, but it's also freeing, collaborative and trust instilling.