# Stop triaging installs that should never have happened.

Your backlog is full of findings for packages that are already on developer machines and already in builds. The work is not detection — you have plenty of detection. The work is everything that follows it.

Human version: https://installsafe.io/for/security-teams

## Detection was never the bottleneck

A finding arrives after the install, which means the remediation path runs through someone else’s sprint. You file the ticket, chase it, and get told it is not exploitable in this context. Repeat several hundred times a quarter.

Meanwhile the install script already ran. For a credential stealer — the category that has driven most npm incidents — detection after the fact is not a partial win, because the secret left the building at install time.

## Moving the control to install time

### Policy at the registry, not in a ticket

Severity threshold, minimum release age, explicit allow and block rules — enforced when the package is requested. A version your policy rejects is never served, so there is nothing to triage.

### One policy every engineer inherits

Set org-wide rather than per developer, so there is no per-machine drift to audit and no honour system to rely on.

### The trail you actually need

Every install and every block recorded per user and per token, with the advisory IDs. Enough for an audit question, without asking developers to log anything.

## What about the vulnerabilities that are already in our tree?

This does not remove them, and nothing that sits at install time can. Point the free scanner at your lockfiles to see what is there today — that inventory is the existing work, and you likely have a tool for it already.

What changes is the inflow. The findings you would otherwise triage next quarter are the ones that never get installed, which is the only part of this problem that compounds in your favour.

## Questions

### Does this replace our SCA scanner?

No, and it is not trying to. A scanner takes inventory of what is in the tree; this refuses to add more. Teams generally keep both, and the scanner’s queue gets shorter.

### What is the failure mode if the proxy is down?

Installs fail the way they would if the registry were down, and the proxy fails open when advisory data is unreachable rather than blocking every install in the org. We publish that behaviour rather than implying total coverage.

### How do developers request an exception?

An allow rule for a specific package or version, set on the account. It is deliberate and recorded, so exceptions stop being invisible decisions made under deadline pressure.

### Where does the advisory data come from?

OSV.dev, the open advisory database, with a local mirror so a single outage does not blind the gate. The same data your scanner most likely uses.