Developer Tools / Code Hosting: the category for code repositories, registries and build services
Engineering teams cannot work without these sites, and attackers like them for the same reasons developers do: they are trusted, fast and allowed. This category lets a filter tell them apart from general technology content.
category[1] Developer Tools / Code Hosting
category[2] Computers & Technology
delivery csv | parquet | json | lookup api
01 What the category includes
Developer Tools / Code Hosting covers services made for people who write, build, test and ship software. The audience is the deciding factor.
Source code hosting
Hosted version control, repositories, merge requests, code review and project wikis for software teams.
Package registries
Public and private registries that distribute libraries and modules for programming languages.
Container and image registries
Registries that store and serve container images and other build artefacts.
Build and deployment services
Continuous integration, test runners, release pipelines and deployment dashboards.
Developer documentation
Language references, framework guides, SDK documentation and API reference sites.
API portals
Developer portals where companies publish APIs, keys, quotas and sandbox consoles.
Online editors and playgrounds
Browser-based IDEs, code sandboxes and runnable snippet tools.
Paste and snippet sites
Services for sharing code fragments, logs and configuration text by link.
Issue and bug trackers
Hosted trackers, public bug portals and roadmap boards for software projects.
Developer observability
Error tracking, log search and performance dashboards aimed at engineers.
SDK and toolchain portals
Official pages for compilers, language runtimes, build tools and software development kits.
Developer Q&A
Question and answer sites where the audience and content are programming specific.
02 What it excludes, and the neighbours
Many technology sites look similar at a glance. The diff below shows which go in and which go to a neighbouring category.
In this category
- A hosted repository service with code review
- A language package registry
- A deployment pipeline dashboard
- A framework's official documentation site
- A browser-based code sandbox
- A public paste service for code and logs
In a neighbouring category
- Tech news and gadget reviews: Computers & Technology
- Web hosts and DNS providers: CDN / Hosting / Infrastructure
- Consumer app downloads: Freeware/Software
- General business SaaS: Web-based Applications
- Generic file lockers: Cloud Storage / File Hosting
- Exploit kits and stolen tools: Malware / Phishing / Suspicious
03 Typical site types
The category holds both very large platforms and a long tail of project sites. These are the shapes we see most.
| Site type | What users do there | Typical users |
|---|---|---|
| Code hosting platforms | Push and pull code, review changes, read project pages | Engineers, students, open source contributors |
| Project home pages | Read about a library, download releases, follow docs | Engineers evaluating a tool |
| Package registries | Install dependencies from build tools and terminals | Build systems as much as people |
| Raw content hosts | Serve files straight from repositories by URL | Scripts, installers and browsers |
| Documentation portals | Search API references and how-to guides | Engineers, technical writers |
| Status and observability pages | Check service health, read error reports | On-call and operations staff |
| Code playgrounds | Write and run small programs in the browser | Students, teachers, interviewers |
| Paste services | Share text by link, often anonymously | Engineers, support staff, and also attackers |
Machine traffic matters. Build servers and package managers reach registries without a browser. DNS and firewall policies that block this category on servers can break builds silently.
04 The security angle
Security teams rarely block the whole category. They do watch a few specific behaviours that ride on trusted developer domains.
Payload hosting
Malicious files are sometimes stored on trusted code or raw content hosts so that downloads look normal.
Source code leaving the company
Pushing internal code to a personal repository is a data loss concern for many firms.
Paste site leaks
Paste services are a known route for leaked credentials and data dumps.
Lookalike packages
Packages with names close to popular ones can carry harmful code. Approved registry lists reduce exposure.
Filter bypass in schools
Online code runners can fetch pages server-side, which some students use to get around filters.
Exposed secrets
Keys and tokens committed by mistake are a reason many firms monitor uploads to public repositories.
Sites built to host malicious code get Malware / Phishing / Suspicious as their main label. For a dedicated feed of those domains, see the phishing and malware domain feed.
05 Who blocks or allows it: policy table
Policy for this category follows roles more than age or venue. The table shows common defaults.
| Environment | Default | Typical rule | Notes |
|---|---|---|---|
| K-12 schools (CIPA) | Allow by group | Allow for computer science classes and staff; restrict paste sites and code runners for younger students. | CIPA does not name this category. It is a local policy choice. |
| Universities | Allow | Open for teaching and research networks. | Security monitoring, not blocking, is the norm. |
| Software companies | Allow | Allow with upload monitoring and an approved registry list. | Blocking breaks daily work. |
| Other businesses | Allow read, control write | Read access for all; uploads and paste sites for IT and engineering only. | Pairs well with data loss controls. |
| High-security networks | Block, allow-list | Block the category and allow internal mirrors and approved registries. | Common in defense and air-gapped settings. |
| Production servers | Allow-list | Only the registries and hosts each build needs. | Reduces supply chain exposure. |
| Guest Wi-Fi | Allow | No restriction beyond security categories. | Visitors may be contractors who need it. |
| Parental control | Allow | Allow for teens learning to code; paste sites optional. | Younger children rarely reach these sites. |
For workplace policy patterns across all categories, see web filtering software for business.
06 Multi-category cases
Each domain can carry several ranked categories. These combinations come up often in this category.
AI coding assistant
[1] AI / LLM Tools [2] Developer Tools / Code HostingPolicies that govern AI use catch it first; engineering allow rules still apply.
Open source project with installers
[1] Developer Tools / Code Hosting [2] Freeware/SoftwareEnd users download builds, developers read source. Both labels are true.
Cloud platform console
[1] CDN / Hosting / Infrastructure [2] Developer Tools / Code HostingHosting leads, with developer tooling as part of the service.
Security research repository
[1] Developer Tools / Code Hosting [2] Computers & TechnologyResearch and defensive tools stay here; sites distributing working attack kits get Malware / Phishing / Suspicious.
Coding course with playground
[1] Webinars/E-learning [2] Developer Tools / Code HostingSchools can allow the course while keeping general playgrounds restricted.
Game modding hub
[1] Gaming [2] Developer Tools / Code HostingGaming rules apply first. See gaming category filtering.
07 How vendors use this category
Products built on our data use the developer label in a few clear ways.
- Secure web gatewaysRole-based rules: allow for engineering groups, read-only for others, with upload inspection on code hosts.
- DNS filtersKeep the category allowed by default so builds do not break, and offer paste sites as a separate toggle.
- Firewalls with external listsPush allow-lists of approved registries as external dynamic lists. Formats are covered in blocklist formats.
- Data loss prevention toolsUse the label to decide where to inspect outbound content more closely.
- School filtersMap the category to a computer science policy group, as described in K-12 web filtering.
- Browser isolationOpen raw content hosts in isolation when the user is not in an engineering role.
On-premise delivery
CSV, Parquet or JSON that run in your own systems, including air-gapped networks.
Daily new domains
About 300,000 new domains a day, rechecked after a week and a month.
08 Policy by role inside one organisation
The same category needs different rules for different people. A role table keeps those rules readable and easy to audit.
| Role | Code hosting | Registries | Paste sites | Online editors |
|---|---|---|---|---|
| Software engineers | Read and write | Allow | Allow, logged | Allow |
| IT and operations | Read and write | Allow | Allow, logged | Allow |
| Data analysts | Read, approved write | Allow | Block | Approved only |
| Customer support | Read only | Block | Block | Block |
| Finance, HR, legal | Read only | Block | Block | Block |
| Build servers | Own repos only | Approved list | Block | Block |
| Students, computer science | Allow | Allow | Teacher choice | Allow |
| Students, other classes | Read only | Block | Block | Class sites only |
These are patterns, not recommendations for every network. Separating read from write usually needs a gateway that can see paths and upload actions, while a DNS filter acts on the whole domain.
09 Signals that move a site out of this category
A domain starts here when it serves developers. These signals show it has become something else, or needs a second label.
Consumer audience
Download pages written for everyday users, with installers and no code, move to Freeware/Software.
Editorial focus
A former project site that now mostly publishes tech news shifts to Computers & Technology.
Working attack tools
Ready-to-use credential stealers or exploit kits move the site to Malware / Phishing / Suspicious.
Bypass utilities
Projects whose main purpose is evading filters add VPN / Proxy / Anonymizers.
Mining scripts
Code that turns visitor devices into miners points to the cryptomining category as well.
Abandoned project domains
Expired project domains that become parked pages move to Parked / For-Sale Domains.
10 Rollout checklist for admins
Changing rules for developer sites affects people and machines. Work through these points before enforcing.
Do
- List which teams and servers need the category
- Separate paste sites from code hosting in your rules
- Keep a short approved registry list for servers
- Log uploads before you block them
- Give engineering a fast exception path
Avoid
- Blocking the category on build servers without testing
- Treating all raw content hosts as malicious
- Copying an engineering policy to student devices
- Relying on the first label only for mixed sites
- Forgetting command-line tools that bypass browser policy
11 Terms policy writers meet in this category
Rules for developer sites are easier to write and review when everyone uses the same words. A short glossary helps non-engineers on the policy team. Share it with whoever approves exceptions.
Repository
A project's code and its full change history, stored on a code host. Can be public or private.
Registry
A service that stores packages or images so build tools can fetch them by name and version.
Mirror or proxy cache
An internal copy of a registry. It lets locked-down networks block the public source while builds keep working.
Raw content host
A domain that serves a repository file directly, without the project page around it. Scripts often fetch from these.
Pipeline
The automated steps that test and release code. Pipelines call registries and code hosts from servers, not browsers.
Build artefact
The output of a build, such as an installer or image, kept for release or later deployment.
Access token
A secret that lets a tool act on a code host. Leaked tokens are a common reason firms watch public uploads.
Fork
A copy of someone else's repository under a new owner. Forks of trusted projects can be altered and shared.
12 FAQ
What does the Developer Tools / Code Hosting category include?
Code hosting and version control, package and container registries, build and deployment services, developer docs, API portals, online editors and paste sites.
Should businesses block developer tools and code hosting sites?
Usually not as a whole. Most allow read access broadly and control uploads, paste sites and unapproved registries.
Why are paste sites in this category?
They were built for sharing code and logs. Because they also carry leaks and payloads, we label them clearly so security teams can treat them separately.
Do schools need to block code hosting under CIPA?
No. CIPA does not address it. Schools usually allow it for computer science and may restrict code runners that can bypass filters.
Is a software download site part of this category?
Downloads for end users go to Freeware/Software. This category is for people who build software.
Will blocking this category break software updates?
It can. Some applications fetch updates or plugins from code hosts and registries. Test on a pilot group and check logs for server and app traffic before enforcing.
Can a DNS filter allow reading but block uploads?
No. DNS works on whole domains. Separating read from write needs a gateway or proxy that sees the request, while DNS can still block paste sites as separate domains.
Where can I see all 59 categories?
The full web filtering categories list describes each one, and the taxonomy page covers the IAB layer.
Can I license this category for my product?
Yes, for internal, OEM or group-wide use. See OEM licensing.
Give your filter a real developer category
120 million domains, 59 categories plus the IAB taxonomy, ranked multi-category labels and daily deltas. Starter database tiers from $999; enterprise and OEM licences are quoted per deployment.