Snyk¶

# Installation
npm install -g snyk                    # Via npm (recommended)
brew install snyk                      # macOS
# Or download from https://github.com/snyk/cli/releases

# Authentication
snyk auth                              # Opens browser for login

# Dependency scanning (Open Source)
snyk test                              # Test current project  # (1)!
snyk test --all-projects               # Test all projects in directory
snyk test --severity-threshold=high    # Fail on high/critical only
snyk test --json > results.json        # JSON output for automation

# Monitor project (sends results to Snyk dashboard)
snyk monitor                           # (2)!

# Fix vulnerabilities
snyk fix                               # Auto-fix (upgrades dependencies)  # (3)!

# Container scanning
snyk container test nginx:latest       # Scan Docker image
snyk container test myapp:1.0.0 --file=Dockerfile  # (4)!
snyk container monitor myapp:1.0.0     # Monitor in dashboard

# Infrastructure as Code scanning
snyk iac test terraform/               # Scan Terraform files
snyk iac test k8s/*.yaml               # Scan Kubernetes manifests
snyk iac test --severity-threshold=high

# Code scanning (SAST)
snyk code test                         # Scan source code  # (5)!
snyk code test --json

# Ignore vulnerabilities
snyk ignore --id=SNYK-JS-LODASH-12345  # Ignore specific vuln
snyk ignore --id=SNYK-JS-LODASH-12345 --reason="False positive" --expires="2026-03-01"

# GitHub Actions integration (.github/workflows/snyk.yml)
name: Snyk Security Scan

on:
  push:
    branches: [main, develop]
  pull_request:
    branches: [main]
  schedule:
    - cron: '0 0 * * 0'  # Weekly scan  # (1)!

jobs:
  security:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master  # (2)!
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high  # (3)!

      - name: Upload result to GitHub Code Scanning
        uses: github/codeql-action/upload-sarif@v3
        with:
          sarif_file: snyk.sarif  # (4)!

  container:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Scan Docker image
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: myapp:${{ github.sha }}
          args: --file=Dockerfile --severity-threshold=high

// .snyk policy file (snyk ignore configurations)
{
  "version": "v1.25.0",
  "ignore": {
    "SNYK-JS-LODASH-590103": {
      "reason": "No upgrade available, low risk",
      "expires": "2026-03-01T00:00:00.000Z",
      "created": "2026-02-02T00:00:00.000Z"
    }
  },
  "patch": {},
  "exclude": {
    "global": [
      "test/**",
      "docs/**"
    ]
  }
}

# CI/CD integration (GitLab CI example)
snyk_scan:
  stage: test
  image: snyk/snyk:node
  script:
    - snyk auth $SNYK_TOKEN
    - snyk test --severity-threshold=high
    - snyk monitor  # Send results to dashboard
  allow_failure: true  # Don't block pipeline initially
  only:
    - merge_requests
    - main