Sonatype Nexus Repository

What it does

The Sonatype Nexus Repository card connects Safeguard to the Docker repositories in a Nexus Repository 3 server (Community or Pro). Safeguard lists your Docker hosted, proxy and group repositories, every image in them and every tag, and each image you select becomes a project that Safeguard scans for an SBOM and vulnerability findings. Each scan is pinned to the digest the tag points at when the scan starts, and pulls the image with the credential you connect. Find the card under Integrations on the Project/Product tab.

Public vs private

Supported auth methods

Permissions required

Safeguard only reads. It never pushes, deletes or tags images, and never changes Nexus settings, except the webhook capability you add yourself (below).

Password

Safeguard does not read the per-repository settings endpoint, so no nx-repository-admin privilege is needed.

Least privilege: a role with the browse and read privileges on the Docker repositories you want scanned, given to a user that has nothing else.

User token

The token acts as its user, so the user needs the same privileges as in the table above. Creating the token needs nx-usertoken-current on that user.

Token types

Expiry: user tokens expire after the User Token Expiry the administrator sets (30 days by default, 1 to 999 days). Set a reminder to rotate before then. Passwords do not expire unless your realm says so.

What we never need: nx-admin, any -add, -edit or -delete repository privilege, nx-repository-admin-*, or any security, blob store or task privilege.

Step-by-step setup

Create the credential in Nexus

1. Sign in as an administrator and open Settings (the gear icon) > Security > Roles > Create Role.
2. Name the role (for example safeguard-read) and add the privileges nx-repository-view-docker-<repository>-browse and nx-repository-view-docker-<repository>-read for each Docker repository (or the * versions for all of them).
3. Open Security > Users > Create local user, give it the safeguard-read role only, set a password and save.
4. Nexus Repository Pro with user tokens: sign in as that user, select the username at the top right, open User Token > Access User Token, re-enter the password and copy the name code and pass code. The dialog closes after one minute.
5. Nexus Community only: an administrator must accept the Community Edition end-user licence agreement once (the onboarding wizard). Until then, Nexus refuses every Docker request.

Or with the Nexus REST API

# As an administrator. Creates the read-only role and user.
curl -u admin -X POST -H "Content-Type: application/json" \
  https://nexus.example.com/service/rest/v1/security/roles \
  -d '{"id":"safeguard-read","name":"safeguard-read","privileges":["nx-repository-view-docker-*-browse","nx-repository-view-docker-*-read"],"roles":[]}'
curl -u admin -X POST -H "Content-Type: application/json" \
  https://nexus.example.com/service/rest/v1/security/users \
  -d '{"userId":"safeguard","firstName":"Safeguard","lastName":"Scanner","emailAddress":"safeguard@example.com","password":"<password>","status":"active","roles":["safeguard-read"]}'

Connect it in Safeguard

1. Open Integrations and choose the Project/Product tab.
2. Click Connect on the Sonatype Nexus Repository card.
3. Choose Private (or Public for anonymous access), enter a Name and the Nexus Repository URL, for example https://nexus.example.com (add the context path, such as /nexus, if your server has one).
4. Private: pick the Sign-in method, then enter the Username (or Name code) and the password or pass code.
5. Docker pull host (optional): Nexus Community serves Docker clients only on a repository's HTTP or HTTPS connector port, or behind a reverse proxy. Enter that host and port, such as nexus.example.com:8443, or one <repository>=<host:port> entry per repository. Leave it empty to use the URL's host with the connector port Nexus reports.
6. Repositories (optional): limit listing to some Docker repositories.
7. Click Verify Credentials (or Check anonymous access). "Connected. N Docker repositories are readable." means Nexus accepted the credential.
8. Click Next, select images and tags, and choose a connect option (fast, progressive or deep scan).

Webhooks and triggers

Scan on push is optional. Open the connection's edit dialog and expand Scan on push (optional) for the Webhook URL (https://api.safeguard.sh/scm/api/v1/registry-webhooks/nexus/<connection id>) and the Secret. In Nexus, open Settings > System > Capabilities > Create capability > Webhook: Repository, choose one Docker hosted or proxy repository (group repositories cannot have one), set Event Types to component, paste the URL and put the secret in Secret Key. Add one capability per repository.

Nexus signs every delivery with an HMAC-SHA1 of the body in X-Nexus-Webhook-Signature; Safeguard refuses deliveries that do not match. A pushed tag is scanned as the version <tag>, pinned to its digest. Without a webhook, rescan on a schedule under Integrations > Scheduled.

What we read and store

• Read: Docker repository names and types, image names, tags, manifest digests and push times, and the images you select for scanning.
• Stored: the connection's settings, the SBOM and findings of each scanned image with its digest, and the credential, which is encrypted at rest and never shown again after you save it.
• Not stored: image layers. The image is read for the scan and not kept.
• No customer data from this integration is sent to third-party LLMs.

Troubleshooting

Rotation and disconnect

• Rotate: set a new password (or reset the user token), find the connection under Project Configurations on the Project/Product tab, choose Update, enter the new value, verify and save. A reset token invalidates the old one at once.
• Disconnect: choose Delete from the connection's menu under Project Configurations and confirm. Then delete the Safeguard user in Nexus and any Webhook: Repository capabilities that point at Safeguard.

Vendor references

• Privileges, checked 2026-10-16.
• User Tokens, checked 2026-10-16.
• Components API, checked 2026-10-16.
• Working With HMAC Payloads, checked 2026-10-16.
• Docker Repository Reverse Proxy Strategies, checked 2026-10-16.
• Community Edition onboarding, checked 2026-10-16.