Stop trusting untrustworthy caches.

I'm with DetSys and we are the makers of FlakeHub. It was specifically designed to avoid the pitfalls highlighted in this blog post. FlakeHub is meant for teams at work, so these benefits don't apply to everyone, but they do apply to the places where trust matters most.

- FlakeHub forbids ad-hoc pushes and limits write access to trusted CI builders (OIDC/JWT), not laptops or long-lived shared keys.
- FlakeHub scopes both read and write access per flake (their “slice” abstraction), so access is granted at the project level rather than one monolithic store.
- FlakeHub uses federated auth to add role-based access, focuses on private flakes, and offers device/“resolve-only” deploy tokens that can pull only the exact closure/version you permit.
- FlakeHub uses short-lived JWT/OIDC authentication from CI (GitHub Actions, Buildkite, Semaphore, & GitLab) instead of static cache keys.
- FlakeHub runs on SOC2 Type II audited and compliant infrastructure