# JFrog Artifactory Hacker Approved page: https://hackerapproved.com/p/jfrog-artifactory/ 14 people recommended JFrog Artifactory in Hacker News comments, 2 had mixed feelings and 28 criticized it, November 2025 to October 2026. It was recommended in 8 of 12 months, in 12 threads. It does not meet the Hacker Approved badge rule. **Verdict:** Criticized more than recommended: critics say it is closed source and has had serious security flaws; those who recommend it see it as a widely used, reliable internal package repository and caching proxy that keeps builds off the public internet. Summary written by Claude from the comments below. ## What people warn about - Security flaws, not hardened for adversaries (3 comments in the sample): "Given the feature explosion and chaos in the Artifactory cache, it is likely vibe coded and hence full of primitive security vulnerabilities." ([source](https://news.ycombinator.com/item?id=49083815)) "the vulnerabilities themselves (mostly in apps developed on the jvm, e.g. artifactory" ([source](https://news.ycombinator.com/item?id=49214427)) "Artifactory is not a hardened piece of software meant for adversarial workloads" ([source](https://news.ycombinator.com/item?id=49877424)) - Not isolated for AI agent sandboxes (3 comments in the sample): "exposing an attack surface as porous as artifactory (the same instance of artifactory) to thousands of agents" ([source](https://news.ycombinator.com/item?id=49828313)) "a part of the system that doesn't provide any isolation guarantees was bridged to the internet" ([source](https://news.ycombinator.com/item?id=49878177)) "It is not intended as a robust and secure packet manager for sandboxes." ([source](https://news.ycombinator.com/item?id=49853916)) - Closed source, code not reviewed (2 comments in the sample): "Any closed source program is insane liability. Trusting in competence of one company is the easiest way to get burnt." ([source](https://news.ycombinator.com/item?id=49855502)) "artifactory is proprietary software that used to be open source, so nobody is looking at the code anymore" ([source](https://news.ycombinator.com/item?id=49854136)) - Costly egress and uncompressed responses (2 comments in the sample): "Given that Jfrog bills on egress for these container images I’m sure you guys saw an eye watering bill for the privilege of distributing your…" ([source](https://news.ycombinator.com/item?id=45790852)) "Artifactory didn’t compress its REST responses, and when you have a CI/CD pipeline that’s been running for six years" ([source](https://news.ycombinator.com/item?id=46737890)) ## Why people recommend it - Widely used, considered a safe choice (3 comments in the sample): "it is widely used and usually considered a safe choice" ([source](https://news.ycombinator.com/item?id=50092547)) "We use artifactory and it also works great" ([source](https://news.ycombinator.com/item?id=47062974)) "enterprise solved this problem long ago" ([source](https://news.ycombinator.com/item?id=47756124)) - Faster proxy for public repositories (3 comments in the sample): "predominantly being more reliable and faster than public repositories" ([source](https://news.ycombinator.com/item?id=49714794)) "Caching proxies are a decent middle ground like Artifactory" ([source](https://news.ycombinator.com/item?id=48370394)) "a middle ground is using Artifactory or whatever as a proxy" ([source](https://news.ycombinator.com/item?id=49878791)) - Keeps production off the internet (2 comments in the sample): "Security minded organisations don't allow cowboy installs into projects, the systems are configured to use internal repos" ([source](https://news.ycombinator.com/item?id=48104780)) "the end effect was production never pulled from the internet" ([source](https://news.ycombinator.com/item?id=47292605)) - Flexible proxying and repository types (2 comments in the sample): "Artifactory is a drop-in replacement for every kind of repository they'll need to work with, and it has a nice UI." ([source](https://news.ycombinator.com/item?id=47444244)) "JFrog supports granular proxy specification by repo." ([source](https://news.ycombinator.com/item?id=46911513)) ## Where to get it - [Visit the official site](https://jfrog.com/artifactory/) ## The badge A product earns the Hacker Approved badge when at least 10 people recommend it, recommenders outnumber critics at least 2 to 1 (mixed feelings count toward neither side), it was recommended in at least 4 of the 12 months and in at least 5 different threads, and no single thread supplies more than half of the people who recommend it. Health and money products are never badged. ## Cite as Hacker Approved, "JFrog Artifactory", https://hackerapproved.com/p/jfrog-artifactory/ (14 recommend, 2 mixed, 28 criticize; Hacker News comments, November 2025 to October 2026). Counts updated 2 Nov 2026, with data through October 31, 2026.