Snyk Erfahrungen

Snyk simplifies security. It can scan your for vulnerabilities during development or when your run a pipeline in azure dev ops. This raises issues before they make it to production so you have the comfort of knowing that new and existing packages have no known security vulnerabilities. I also really like the ability to one click fix issues within Synk where it can automatically fix the issue and create a PR within azure devops - this simplifies the process and saves time.

Not all issues have a 1 click fix which is understandable.

As a long time fan of open source software, keeping track of security issues amidst an ever growing software stack was increasingly an impossible task. I was so grateful to find a service like Snyk that does the hard work for me - keeping an eye on any security issues so I can focus on building great software!

The pricing structure gets extremely expensive for medium to large companies, but thankfully for smaller organisations there is a free tier which covers our needs.

Nice component analysis tool, great interface and dashboards. Very fast and easy deployment and use.

SAST component is very weak and don’t support increment scanning.

Have been using Snyk for around 1 year now and it's one of the tool which we can't avoid though it annoys us now and then by finding new vulnerabilities in our packages and forcing us to mitigate the risk. They provide details of the vulnerability and in most cases the version to fix it. It integrates very well with the build pipelines and other CI/CD tools along with a nice IntelliJ plugin.

Sometimes the UI is confusing and access management is a bit vague.

Concise reporting and the vulnerability scan is excellent regarding categorization of issues.

Nothing really. It is excellent as it is.

I liked the easy of setting the tool up. I did not have to spend a lot of time configuring this tool.

The user interface can be a bit short on details. When I go to use it, there are really just a few items that say "everything is fine".

Active scan for malicious software.
Freeware model for small businesses with single project.
Nice dashboard and nice CLI for SSH access.

The cheapest paid plan should cost a bit less

The automated repository analysis is pretty good and can be easy to plug into your PR (pull request) validator

The security analysis is very primitive and often flags false positive which has to be fixed with manual override or skipping the PR validation check

Snyk was easy to setup and use. The weekly reports are a great way to regularly check in on overall package health. The alerts on new vulnerabilities are very useful and enable us to respond to important issues rapidly.

No problems using the tool so far. I look forward to more information on vulnerability resolution in the platform.

We can identify security vulnerabilities during the development and fix them. Its easy to use, and the depth at which the scans are performed to find the vulnalerabities is great.

Nothing as much, but the pricing is expensive.

Snyk is easy to use, provides clear feeback, integrates well into GitHub

Doesn't always update its results the fastest

it gave me really useful code to add to mine in really creative ways I didn't think about before using it

your barely get any suggestions till you start typing, i feel this takes a lot of creativity out. just my opinion

It took only seconds to set up, yet works for my projects every day. Knowing what my venerabilities are during the development phase allows the evaluation of the concern prior to code ever seeing production

I wish it had a way to automatically inform the creators in the chain of dependencies so we as developers did not have to.

Informative email messages when vulnerabilities are found in dependencies. Very clear explanations.
I also appreciate the email newsletters.

So far nothing. It seems to fit my use-case really well.

Quick results for vulnerabilities scanning

I did not like the user interface. You should provide some dashboard

It is fast at making the fixes
it explains thing well

that I don't understand if the changes will break my code