ActiveState Curated Catalog Secures AI-Generated Code Throughout Any Improvement Surroundings

As AI coding assistants proliferate, ActiveState delivers the one tool-agnostic, built-from-source open supply safety layer that governs dependency ingestion no matter which AI device builders use

ActiveState, a world chief in trusted, managed open supply software program, introduced expanded assist for AI-assisted improvement environments via the ActiveState Curated Catalog. As a result of the Curated Catalog delivers open supply elements via commonplace artifact repositories and native package deal managers, it really works wherever builders pull dependencies, together with AI coding environments reminiscent of Cursor, Claude Code, GitLab Duo, Tabnine, Windsurf, and JetBrains AI. Safety governance strikes with the developer, not round them.

The Downside: AI Coding Assistants Generate Open Supply Danger at Machine Pace
The safety threat on the coronary heart of AI-assisted improvement will not be the AI device itself. It’s the open supply software program these instruments pull from public registries when producing code. Each immediate is a possible dependency request, and the registries these requests hit weren’t designed with enterprise safety posture in thoughts. The assault floor is increasing at machine velocity, and the safety groups answerable for it will not be.

How the ActiveState Curated Catalog Works
The ActiveState Curated Catalog addresses this instantly. Safety groups curate a personal, policy-governed repository of open supply elements drawn from the ActiveState Library, a set of greater than 79 million elements constructed from supply inside SLSA Degree 3 infrastructure. When an AI coding assistant requests a package deal or a dependency, it pulls from that curated catalog relatively than a public registry. Making certain that builders use packages which are constructed from supply, repeatedly monitored, and mechanically up to date when community-approved fixes can be found. Governance is embedded on the level of consumption, which is the one place it could actually realistically hold tempo with AI-generated code quantity.

Additionally Learn: AiThority Interview with Glenn Jocher, Founder & CEO, Ultralytics

Key Capabilities

• Instrument-agnostic integration: Works with any AI coding assistant that pulls dependencies from commonplace artifact repositories or native package deal managers, together with Cursor, Claude Code, GitLab Duo, Tabnine, Windsurf, and JetBrains AI.
• 79 million built-from-source elements throughout 12 languages: Each part within the ActiveState Library is constructed from supply inside SLSA Degree 3–compliant infrastructure, delivering verified provenance and an immutable audit path.
• Contractual SLAs for vulnerability remediation: Important CVEs remediated inside 5 enterprise days, excessive inside 10, and all others inside 30, towards an trade common imply time to remediate that lags upwards of 60 days.
• Native artifact repository compatibility: Works seamlessly with standard artifact repositories like JFrog Artifactory, Sonatype Nexus, GitHub Packages, AWS CodeArtifact, GitLab Package deal Registry, Google Artifact Registry, Azure Artifacts, and others. No new tooling or CI/CD modifications required.
• Steady monitoring and automated updates: When the open supply neighborhood releases a repair, ActiveState builds and publishes the up to date part mechanically. Safety groups will not be handed a CVE backlog to handle themselves.
  Why Safety Can not Be Tethered to a Single AI Instrument
  “The market is transferring towards deeply coupled integrations between particular person AI coding instruments and safety distributors,” stated Abby Kearns, CEO, ActiveState. “That’s the improper body. Your builders will not be utilizing one AI device, they usually might not be utilizing the identical one in 18 months. The safety layer can’t be coupled to the device. It needs to be coupled to the dependency. That’s precisely what the Curated Catalog does, and it’s why our structure was constructed this fashion from the beginning.”
  What This Means for Safety Leaders: Provenance, Compliance, and Private Legal responsibility
  Within the 2026 regulatory atmosphere, the burden of proof has shifted. The EU Cyber Resilience Act and SEC disclosure necessities place the onus on safety leaders to reveal that software program was safe on the level of origin. Pointing to a scanner will not be a enough protection. ActiveState’s immutable provenance, automated audit trails, and contractual remediation SLAs represent a fairly designed program beneath present regulatory frameworks, one which protects the group and the safety chief personally.