Freedom251 › Artifact repository software

Repman

Free plan APISelf-hostedWeb

What Repman is

Repman is a PHP repository manager for private Composer dependencies. It can run as a cloud service or behind your firewall, and its free plan is available for either approach. A Packagist proxy handles packages from packagist.org and uses a global CDN for Composer downloads. Private packages may come from VCS repositories, PEAR channels, directory paths, or artifacts, with Git, SVN, Fossil, and Mercurial supported. Repman can import private repositories from GitHub, GitLab, and Bitbucket, then synchronize new versions through webhooks. Its scanner checks composer.lock dependencies against the FriendsOfPHP Security Advisories database, updated every two hours. Successful synchronizations trigger scans, and manual scans are also available. Vulnerabilities produce warnings and optional email alerts for organization members. Authorization tokens control package access, while owners manage packages, members, settings, and tokens. A REST API uses a generated X-API-TOKEN value. The MIT-licensed project supports Docker or Ansible installation. Installation statistics currently combine all package versions.

Who it suits

Repman suits teams managing private PHP Composer packages that need cloud or self-hosted deployment. It also fits organizations wanting repository imports, access tokens, synchronization, and dependency security alerts.

What it does well

Free cloud or self-hosted plan
Packagist proxy with global CDN
Imports GitHub, GitLab, and Bitbucket repositories
Scans dependencies for known vulnerabilities
Docker and Ansible installation options

What to know first

Statistics combine all package versions
Per-version statistics are not currently available
Client data servers are located in the United States

Plans

Plan	Billed and limits	Price
Free	Free of charge · cloud or self-hosted	Free

As repman.io lists them, read 11 Oct 2026. The maker's own page has the final word.

Verdict

Repman combines private Composer package management, repository imports, synchronization, and security scanning in a free service. Teams can use its cloud deployment or install the MIT-licensed project themselves, while accepting combined version statistics and the stated data location.

Facts from Repman's own pages

Access control: Organizations use authorization tokens to make packages available, and owners can manage packages, members, organization settings, and tokens. · repman.io, 11 Oct 2026
API: Repman offers a REST API that uses a generated API token in the X-API-TOKEN request header. · repman.io, 11 Oct 2026
Data location: Repman's privacy policy says client data is stored using Amazon Web Services and that physical servers for the service are located in the United States. · repman.io, 11 Oct 2026
Headquarters: Warsaw, Poland · repman.io, 28 Sept 2026
Integrations: Repman provides native private repository import integrations with GitHub, GitLab, and Bitbucket. · repman.io, 11 Oct 2026
Maker: The privacy policy identifies BDY Sp. z o. o. Sp. k. as Repman and lists its registered office at Migdałowa 4, 02-796, Warszawa, Poland. · repman.io, 11 Oct 2026
Package sources: Private packages can come from VCS repositories, PEAR channels, directory paths, or artifacts; supported VCS types include Git, SVN, Fossil, and Mercurial. · repman.io, 11 Oct 2026
Packagist proxy: Its proxy supports packages from packagist.org and uses a global CDN to speed up Composer dependency downloads. · repman.io, 11 Oct 2026
Security scanning: The built-in scanner checks composer.lock dependencies against the FriendsOfPHP Security Advisories database, which is updated every two hours. · repman.io, 11 Oct 2026
Self-hosting: The MIT-licensed standalone project can be installed on a server using Docker or Ansible playbooks. · repman.io, 11 Oct 2026
Statistics limit: Package installation statistics currently count all versions together; per-version statistics are described as forthcoming. · repman.io, 11 Oct 2026
Support: The site directs users with questions or suggestions to open an issue. · repman.io, 11 Oct 2026
Version sync: Repman automatically syncs new package versions using webhooks. · repman.io, 11 Oct 2026
Vulnerability alerts: When a vulnerability is detected, Repman displays a warning and can email organization members; scans run after successful package synchronization and can also be triggered manually. · repman.io, 11 Oct 2026
What it does: Repman is a PHP repository manager for managing private PHP Composer dependencies in the cloud or behind your firewall. · repman.io, 11 Oct 2026

Where Repman stands on Freedom251

Artifact repository software#40 of 64