# Repository Firewall Best Practices: Policy Compliant Component Selection

**URL:** <https://community.sonatype.com/t/repository-firewall-best-practices-policy-compliant-component-selection/12225>\
**Category:** Sonatype Lifecycle & Firewall\
**Tags:** firewall, nexus-repository, pypi, npm, best-practice\
**Created:** [March 8, 2024, 6:04pm UTC](https://community.sonatype.com/t/repository-firewall-best-practices-policy-compliant-component-selection/12225 "2024-03-08T18:04:41Z")\
**Posts on this page:** 1\
**Showing post:** 7

<div class="post-metadata">

**Author:** ![jzora](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/jzora/32/4197_2.png) [@jzora](https://community.sonatype.com/u/jzora)\
**Post date:** [September 24, 2024, 3:29pm UTC](https://community.sonatype.com/t/repository-firewall-best-practices-policy-compliant-component-selection/12225/7 "2024-09-24T15:29:25Z")

</div>

Good question, Navneet. If there are no policy compliant versions of the package available, then the package goes to quarantine and stays in quarantine until it’s manually released by a waiver.

[Waiver documentation is here.](https://help.sonatype.com/en/waivers.html) [Or watch a video here.](https://learn.sonatype.com/learn/courses/13/release-a-component-from-quarantine)

As for the life cycle of these packages, that depends on your level of risk tolerance. Our most successful customers have developers send waiver requests to a central location (a Teams channel, an email address) which are then individually evaluated by a team leader or security pro.

---

_[View the full topic](https://community.sonatype.com/t/repository-firewall-best-practices-policy-compliant-component-selection/12225)._