Make the mirror the easiest route and the only reachable one. Block public registry hosts at the network edge for build systems, ship registry settings as managed configuration, scan for overrides in code review, and monitor for direct fetches. Then remove the reasons people bypass it, mainly slow requests.
Why bypass happens
Developers rarely bypass out of malice. A package is missing, the approval queue is slow, or a local override was the quickest way to unblock a deadline. If you only add rules, people find a way round. If you also fix the friction, most stop trying.
Five controls
- Network enforcement. Build runners and servers cannot reach public registries directly. This is the control that does not depend on goodwill. See an egress allowlist you can enforce.
- Managed configuration. Registry settings come from a central file or image, not from each developer. Pair this with scoped tokens so credentials work only for the mirror. Our notes on npmrc scoped registry and token scoping show one ecosystem's approach.
- Review rules. Pull requests that change registry URLs, add direct URL dependencies or add download steps get flagged for a security reviewer.
- Gate checks. The build fails if a lockfile entry points at a host other than the mirror.
- Monitoring. Alert on connection attempts to public registry hosts from build networks, and on package fetches that do not appear in mirror logs.
Detecting the quiet cases
Some bypasses leave no failed connection. Look for these:
| Pattern | Where to look |
|---|---|
| Registry URL changed in a project file | Repository search and review rules |
| Dependency pointing to a Git URL or tarball | Lockfile scan |
| Install script downloading binaries | Build log review |
| Image built outside CI and pushed by hand | Registry push logs by identity |
| Vendored copy of a library | Directory scan for unexpected third party code |
Reduce the reasons to bypass
- Publish a request turnaround target and report against it.
- Offer a clear emergency path.
- Suggest an approved alternative with every rejection.
- Let developers see the mirror contents, so they can check before asking.
Measure how many requests arrive and how long they take. If the median wait is days, expect workarounds. The measurement also helps you justify more reviewer time.
Handle a discovered bypass
Treat it as a process signal first. Find out why it happened, review what was pulled, record the finding, and fix the cause. Disciplinary action should be reserved for repeated or deliberate evasion, and is a matter for your own HR processes.
Quick check
Is blocking public registries enough?
It stops direct fetches, but not vendored code or artifacts built elsewhere. Combine it with review rules and build only in CI.
Should laptops be blocked too?
That is a policy choice. If releases are built only in CI, laptops can be more lenient while still being monitored.
Safeguard policies and gates can flag unapproved sources in pull requests, and asset discovery can help find unmanaged code. Try the free scan at gold.safeguard.sh/scan.
Last reviewed: 19 October 2026.
