Snyk Dependency Scanning: Automated Vulnerability Testing in PRs and CI

# Install globally via npm
npm install -g snyk

<span class="hljs-comment"># Or use npx for one-off runs without installation
npx snyk --version

<span class="hljs-comment"># Authenticate (opens browser for OAuth flow)
snyk auth

<span class="hljs-comment"># Authenticate with a token in CI environments
snyk auth <span class="hljs-variable">$SNYK_TOKEN

# Test the current project for vulnerabilities
snyk <span class="hljs-built_in">test

<span class="hljs-comment"># Show full vulnerability paths in the output
snyk <span class="hljs-built_in">test --all-projects --print-deps

<span class="hljs-comment"># Output results as JSON for further processing
snyk <span class="hljs-built_in">test --json > snyk-results.json

<span class="hljs-comment"># Fail only on High and Critical findings
snyk <span class="hljs-built_in">test --severity-threshold=high

Testing /app...

✗ High severity vulnerability found in lodash
  Description: Prototype Pollution
  Info: https://snyk.io/vuln/SNYK-JS-LODASH-567746
  Introduced through: myapp@1.0.0 › some-library@2.3.0 › lodash@4.17.15
  From: myapp@1.0.0 › some-library@2.3.0 › lodash@4.17.15
  Fix: Upgrade some-library to 2.4.1 (which upgrades lodash to 4.17.21)

✗ Medium severity vulnerability found in axios
  Description: Server-Side Request Forgery (SSRF)
  Info: https://snyk.io/vuln/SNYK-JS-AXIOS-1579269
  Introduced through: myapp@1.0.0 › axios@0.21.1
  From: myapp@1.0.0 › axios@0.21.1
  Fix: Upgrade axios to 0.21.2

Organization:      my-org
Package manager:   npm
Target file:       package.json
Open source:       no
Project name:      myapp

# Send current snapshot to Snyk for ongoing monitoring
snyk monitor --project-name=<span class="hljs-string">"production-app"

# Scan requirements.txt
snyk <span class="hljs-built_in">test --file=requirements.txt --package-manager=pip

<span class="hljs-comment"># Scan Pipenv project
snyk <span class="hljs-built_in">test --file=Pipfile

<span class="hljs-comment"># Scan Poetry project
snyk <span class="hljs-built_in">test --file=pyproject.toml --package-manager=poetry

name: Snyk Security Scan

on:
  pull_request:
    branches: [main, develop]
  push:
    branches: [main]
  schedule:
    - cron: "0 6 * * 1"  # Weekly Monday 6am

jobs:
  snyk-dependency-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Setup Node.js
        uses: actions/setup-node@v4
        with:
          node-version: "20"

      - name: Install dependencies
        run: npm ci

      - name: Run Snyk dependency scan
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high --sarif-file-output=snyk.sarif

      - name: Upload SARIF to GitHub Security tab
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: snyk.sarif

  snyk-code-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Run Snyk Code (SAST)
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          command: code test
          args: --sarif-file-output=snyk-code.sarif

      - name: Upload Code SARIF
        uses: github/codeql-action/upload-sarif@v3
        if: always()
        with:
          sarif_file: snyk-code.sarif

# Scan a local Docker image
snyk container <span class="hljs-built_in">test myapp:latest

<span class="hljs-comment"># Scan with base image recommendations
snyk container <span class="hljs-built_in">test myapp:latest --file=Dockerfile

<span class="hljs-comment"># Specify platform for multi-arch images
snyk container <span class="hljs-built_in">test myapp:latest --platform=linux/amd64

<span class="hljs-comment"># Output as JSON
snyk container <span class="hljs-built_in">test myapp:latest --json > container-results.json

  snyk-container-scan:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Build Docker image
        run: docker build -t myapp:${{ github.sha }} .

      - name: Scan container image
        uses: snyk/actions/docker@master
        env:
          SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
        with:
          image: myapp:${{ github.sha }}
          args: --file=Dockerfile --severity-threshold=high

# Test for license issues alongside vulnerabilities
snyk <span class="hljs-built_in">test --all-projects

<span class="hljs-comment"># Get license information only
snyk <span class="hljs-built_in">test --json <span class="hljs-pipe">| jq <span class="hljs-string">'.licensesPolicy'

<span class="hljs-comment"># Use organisation-level license policy
snyk <span class="hljs-built_in">test --org=my-org

# .snyk
version: v1.25.0

ignore:
  SNYK-JS-LODASH-567746:
    - "*":
        reason: >
          This vulnerability requires prototype pollution via a code path
          that is unreachable in our application — all user input is
          validated against a strict JSON schema before reaching lodash.
        expires: "2026-09-01T00:00:00.000Z"
        created: "2026-05-19T00:00:00.000Z"

  SNYK-PYTHON-REQUESTS-3233415:
    - "requests > 2.27.1":
        reason: >
          CVE only affects requests when used with the chardet library.
          We use charset-normalizer as specified in requirements.txt.
        expires: "2026-08-01T00:00:00.000Z"

patch: {}

# Run SAST scan on current directory
snyk code <span class="hljs-built_in">test

<span class="hljs-comment"># Focus on specific directory
snyk code <span class="hljs-built_in">test src/

<span class="hljs-comment"># Set severity threshold
snyk code <span class="hljs-built_in">test --severity-threshold=medium