Snyk Security Scanner: Vulnerability Scanning & Fix PR Guide

Snyk finds and fixes vulnerabilities in your dependencies, containers, and infrastructure code — before they reach production. This guide covers the full workflow from CLI setup to CI/CD integration and policy management.

What is Snyk (vs npm audit)?

npm audit checks Node.js packages against the npm advisory database — it's built-in and free but limited. Snyk goes further: it covers 10+ ecosystems, scans Docker images and IaC, integrates with GitHub/GitLab/Bitbucket to open automated fix PRs, and continuously monitors your deployed projects for newly disclosed CVEs.

Snyk has a free tier that covers open-source projects and up to 200 tests/month for private repos. Most teams find the free plan sufficient for CI gating.

CLI Quickstart

Install globally and authenticate with your Snyk account token:

# Install
npm install -g snyk

# Authenticate (opens browser)
snyk auth

# Test current project
snyk test

# Monitor project on Snyk platform (continuous tracking)
snyk monitor

# Auto-fix vulnerabilities and open a PR
snyk fix

Run snyk test --severity-threshold=high to exit non-zero only when high or critical issues are found, keeping CI from failing on low-risk advisories.

CI/CD Integration — GitHub Actions

name: Snyk Security Scan

on: [push, pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Set up Node.js
        uses: actions/setup-node@v4
        with:
          node-version: '20'

      - run: npm ci

      - name: Run Snyk to check for vulnerabilities
        uses: snyk/actions/node@master
        env:
          SNYK_TOKEN: {{ secrets.SNYK_TOKEN }}
        with:
          args: --severity-threshold=high

Add SNYK_TOKEN to your repository secrets. Generate it from Snyk Dashboard → Account Settings → API Token.

Container Scanning

Snyk can scan Docker images — both the OS layer and any app dependencies baked into the image:

# Scan a local or remote image
snyk container test node:18-alpine

# Scan your own image
snyk container test myapp:latest --file=Dockerfile

# Monitor container on Snyk platform
snyk container monitor myapp:latest

Snyk shows which base image layer introduced each vulnerability and suggests a patched or slimmer alternative (e.g., switching from node:18 to node:18-slim can eliminate dozens of OS-level CVEs).

IaC Scanning (Terraform, Kubernetes)

# Scan Terraform files
snyk iac test ./infra/

# Scan Kubernetes manifests
snyk iac test k8s-manifests/

# Scan a single file
snyk iac test deployment.yaml

Snyk IaC detects misconfigurations like open security groups, containers running as root, missing resource limits, and disabled audit logging — before you apply changes to production.

.snyk Policy File — Managing False Positives

The .snyk file lets you suppress known false positives or accepted risks:

# .snyk
version: v1.25.0
ignore:
  SNYK-JS-LODASH-567746:
    - '*':
        reason: Not exploitable — no user-controlled input reaches this path
        expires: '2025-12-31T00:00:00.000Z'
        created: '2024-01-15T10:00:00.000Z'

Always include a reason and expires date. Commit .snyk to version control so the entire team and CI pipeline share the same suppression rules.

Snyk vs Alternatives