Snyk
Finds and fixes vulnerabilities across code and dependencies
Snyk scans the places a vulnerability can enter an application and tells you where the fix goes. Snyk Code checks your own source as it is written, Open Source flags vulnerable dependencies and licence problems, Container scans base images, IaC catches misconfigurations before they are applied, Secrets looks for credentials committed by accident, and API and Web adds dynamic testing of running applications. It runs where developers already are - an IDE plugin, a CLI, and integrations with GitHub, GitLab, Bitbucket and Azure Repos - so a pull request can be blocked or a fix suggested inline rather than reported weeks later. Paid plans raise test limits and add Jira integration, custom security policies and reporting; Enterprise adds governance across an application security programme. Pricing counts contributing developers rather than seats, and data can be hosted in the US, EU or Australia.
- Snyk Code scans your own source as it is written
- Open Source flags vulnerable and badly licensed packages
- Container scanning for base images
- Infrastructure as code misconfiguration checks
- Secret detection for credentials committed by accident
- Dynamic testing of running APIs and web apps
- IDE plugin, CLI and source control integrations
- Data hosted in the US, EU or Australia
Based on what people have said
Every answer links back to the mentions it came fromHow does Snyk perform as a SAST tool?
Some users consider Snyk to have a strong SAST engine, particularly for JavaScript and TypeScript. However, others note that AI models have occasionally identified vulnerabilities, such as SQL injections, that Snyk's own reference set missed.
2 mentions · r/devsecops · @liran_tal · Aug 2026 – Sep 2026
What are the common concerns regarding Snyk's current standing?
Several users have expressed reservations about the company's current corporate stability and direction. Some observers suggest that AI-native competitors are increasingly challenging traditional scanner tools like Snyk.
3 mentions · r/devsecops · @rdominguezibar · Aug 2026 – Sep 2026
How do users integrate Snyk into their security workflows?
Users employ Snyk for various tasks, including scanning containers for vulnerabilities and flagging high-risk security issues. It is often compared to or used alongside other tools like Gitleaks, Trivy, and Sonar, with some users preferring to combine multiple specialized tools rather than relying on a single solution.
5 mentions · r/typescript · r/selfhosted · r/reactjs · r/SpringBoot · Aug 2026 – Sep 2026
These summarise counts and dates only. Read the quotes themselves under what people are saying.
What people are saying about Snyk
69% neutral“I would recommend Checkmarx One and Black Duck over Snyk. Snyk is going through a lot of corporate instability right now.”
“Snyk has probably the best SAST engine for JS/TS from my experience, but the company is going through a lot of changes and I’m not confident their direction is sound so take that in mind, but they are not the market leader they used to be.”
“check out tools like Checkmarx or Snyk for SAST and OWASP ZAP for DAST. for training, OWASP itself has great resources, plus look into platforms like Pluralsight or Udemy for courses on the top 10.”
“I wouldn't say it's better than Gitleaks, Trivy, or Snyk individually. The idea is just to combine repo health, security, dependencies, Git, and other checks into one local command.”
“why would this be better than using something like gitleaks + trivy, snyk, or a 15 line github action?”
“Apart from the obvious things like a correctly setup firewall and separate blank, I also run Snyk to scan my containers for possible vulnerabilities. I let renovate bot update my cluster deployments and every time an update is found automated checks will get executed to ensure the deployment update is stable enough before it even gets deployed.”
“Between them, Microsoft Defender Experts, Huntress, Snyk, and the Cloud Security Alliance have documented both patterns. 🧵”
“I think Snyk flags this as a high security risk.”
“Not trying to replace Sonar or Snyk, just the narrow set of things AI assistants specifically keep getting wrong.”
“AI-native rivals like Anthropic's Claude are eating scanner tools like Snyk's from the”
“84.8% of reference-matched vulnerabilities recurred in all 5 identical runs. Only 13.7% of "extra" findings did. @snyksec's VulnBench JS 1.0 measured what actually repeats when AI reviews code.”
“This: the models caught a real SQL injection our own Snyk Code reference set missed. we published that too. the point was never "Snyk wins," it's an honest map of where each tool is strong:”
“I know of SAST tools -- i.e., Snyk, Sonar, Mend, that use GenAI to compliment their analysis. I don't know of much out there that is first and foremost a AI-based scanner.”