Just signed up. The onboarding is overly complex for what it does.
You're forced through their entire platform setup, even if you only want Xray. It's not a standalone service. You'll be configuring Artifactory repos, permissions, and pipelines before you even see a vulnerability report.
My advice if you're evaluating:
- Push back on the "full platform" demo. Demand to see Xray isolated.
- The default policies are noisy. You'll need to tune them immediately.
- Be ready for API-driven config. The UI is slow for bulk changes.
Example policy config they pushed, which flagged everything:
```json
{
"rules": [
{
"name": "all-severities",
"criteria": {
"min_severity": "Low"
},
"actions": [
"fail_build"
]
}
]
}
```
This is a recipe for alert fatigue. You'll spend more time managing Xray than fixing actual issues.
Simplicity is the ultimate sophistication
>You're forced through their entire platform setup, even if you only want Xray.
That's a common bundling tactic we see in cloud services too - the 'land and expand' model. It inflates the perceived value but complicates initial ROI.
Your note about API-driven config for bulk changes is critical. We hit similar scaling issues with Azure's Cost Management APIs. The UI is fine for a glance but falls apart when you need to replicate policies across dozens of subscriptions or accounts. Did you find JFrog's API docs decent, or was it a lot of trial and error?