snyk

Test project for vulnerabilities

$ snyk test

$ snyk test --file=[package.json]

$ snyk monitor

$ snyk container test [image:tag]

$ snyk iac test [/path/to/terraform/]

$ snyk code test

$ snyk auth

$ snyk ignore --id=[SNYK-JS-LODASH-567746]

snyk command [--file file] [--severity-threshold level] [options] [target]

Snyk finds and fixes vulnerabilities in code, dependencies, containers, and infrastructure as code. It integrates into development workflows, CI/CD pipelines, and provides continuous monitoring.
Dependency testing scans package manifests (package.json, requirements.txt, pom.xml, etc.) against Snyk's vulnerability database. Results show CVEs, severity, and available fixes.
Container scanning analyzes Docker images layer by layer, identifying vulnerable packages in base images and application dependencies. Recommendations include secure base image alternatives.
Infrastructure as Code testing catches misconfigurations in Terraform, CloudFormation, Kubernetes, and other IaC files before deployment. Issues include security groups, encryption settings, and access controls.
Static analysis (code test) finds security issues in source code: injection flaws, hardcoded secrets, and other vulnerabilities.
The monitor command creates a snapshot in Snyk's service for ongoing vulnerability alerting as new CVEs are discovered.

test

Test project for vulnerabilities.

Record project snapshot for monitoring.

Test container image.

Monitor container image.

Test Infrastructure as Code.

Test source code (SAST).

Authenticate with Snyk.

Ignore an issue.

Interactive remediation.

Manage .snyk policy file.

Manifest file to test.

Only report: low, medium, high, critical.

Output as JSON.

Output as SARIF.

Test all projects in directory.

Fail on: all, upgradable, patchable.

Prune repeated dependencies.

Debug output.

Specify organization.

Requires account for full functionality. Some features need paid plans. Internet required for database access. Large projects take time to scan. False positives possible. Not all package ecosystems fully supported.

Snyk was founded in 2015 by Guy Podjarny. The name is "kyns" (open source security) reversed. Starting with JavaScript dependency scanning, it expanded to containers, IaC, and code analysis. The company raised significant funding and became a leader in developer security tools.

npm-audit(1), safety(1), trivy(1), checkov(1)