snyk/cli

Features

• Multi-Target Security Scanners - Scans open-source dependencies, application code, container images, and IaC for known vulnerabilities via a CLI.
• Application Security Testing - Provides static and dynamic analysis to detect security vulnerabilities across dependencies, code, containers, and infrastructure configurations.
• Vulnerability Scanning - Scans dependencies, source code, container images, and IaC files for known security vulnerabilities.
• Static Code Analysis - Performs static analysis on custom source code to detect security weaknesses like injection flaws and secret leaks.
• Command Line Tooling - Scans code for known security issues during development using command line tools and build pipelines.
• Package Registry Integrations - Integrates with private package registries to resolve transitive dependencies for accurate scanning.
• Vulnerability Scanning Integrations - Resolves dependencies from private registries to enable vulnerability scanning and automatic fix generation.
• Security Automation APIs - Offers REST endpoints to programmatically trigger project security scans.
• Security Fix Pull Requests - Automatically creates pull requests to patch vulnerable dependencies to secure versions.
• Security Scanning Gates - Scans each pull request for vulnerabilities and blocks merging when security policies are violated.
• Build Pipeline Scanning - Integrates security scanning into build pipelines to prevent vulnerable code from being deployed.
• CI/CD Pipeline Integrations - Embeds vulnerability scanning into CI/CD pipelines to break builds on critical issues.
• Security Scanning Integrations - Embeds vulnerability scanning into CI/CD pipelines and fails builds when security policy thresholds are exceeded.
• Security Gating - Embeds vulnerability scanning into CI/CD pipelines and fails builds when critical security issues are detected.
• Vulnerability Fix PR Generators - Generates pull requests that upgrade vulnerable dependencies to patched versions automatically.
• Scan Result Uploads - Submits scan results to the platform for continuous monitoring and automatic vulnerability alerting.
• Security Gates - Fails builds when tests detect vulnerabilities in open source, code, infrastructure-as-code, or containers.
• Vulnerability-Based Build Gating - Fails build pipelines when scan results violate security policy thresholds.
• Dependency Vulnerability Scanners - Creates snapshots of dependencies and sends alerts when new vulnerabilities or fixes are discovered over time.
• Vulnerability Alerts - Monitors projects and sends alerts when new vulnerabilities are discovered in dependencies.
• Service Account Authenticators - Creates system users with API tokens to authenticate automated processes at organization or group level.
• Misconfiguration Scanning - Scans Terraform and YAML configuration files for security misconfigurations and vulnerabilities before deployment.
• Multi-Format Vulnerability Reports - Produces vulnerability reports in HTML, JSON, and SARIF for review or automation.
• Multi-Method API Authentication - Supports OAuth, personal access tokens, and service accounts for CLI, IDE, and CI/CD authentication.
• Policy Enforcement Engines - Evaluates scan results against configurable policy rules to fail CI/CD pipelines when conditions are met.
• Private Repository Ingestion Services - Configures a proxy client to scan private repositories for vulnerabilities without exposing credentials.
• Proxy Client Integrations - Configure a proxy client with basic authentication and endpoints to connect a vulnerability scanning platform to a Bitbucket Server instance.
• Private Repository Analysis Services - Analyzes private Git repositories by deploying proxies that bridge scanning services and internal code.
• Vulnerability Scanning Proxies - Deploys reverse proxies for scanning private code and registries without exposing internal credentials.
• Role-Based Access Control - Manages user permissions through predefined and custom roles across organizational levels.
• Secure Broker Networks - Deploys broker networks to securely route scanning requests to private environments.
• Docker-Based Secure Proxy Deployments - Deploy a secure proxy client using Docker to securely bridge a self-hosted Git server with a cloud security scanning service.
• Dependency Vulnerability Scanning - Scans open-source dependency trees across multiple ecosystems for known vulnerabilities and license issues.
• Language-Specific Plugin Loaders - Loads language-specific scanner plugins at runtime for accurate dependency resolution and code analysis across ecosystems.
• Rust Dependencies - Scans Rust dependencies for vulnerabilities using SBOM testing and API queries.
• Scala sbt Dependencies - Scans Scala sbt-managed dependencies for security vulnerabilities and license compliance.
• Swift and Objective-C Dependencies - Scans Swift and Objective-C dependencies for known vulnerabilities.
• TypeScript Dependencies - Scans TypeScript dependencies for known security vulnerabilities.
• Security Proxies - Deploys a containerized proxy to bridge scanning services with private repositories securely.
• Security Scanning Broker Connections - Deploys a reverse proxy agent that securely bridges scanning services with private Git servers and registries.
• Multi-Repository Proxies - Connect a scanning service to multiple private repositories by running a single broker client that handles diverse connection types while keeping credentials inside the network.
• CI/CD - Blocks deployments when critical vulnerabilities are detected through integrated scanning in CI/CD pipelines.
• Plugin-Based Scanners - Loads language-specific scanner plugins at runtime for manifest parsing, lockfile analysis, and static analysis.
• Infrastructure Template Analysis - Checks infrastructure-as-code templates against security rules to prevent misconfigured deployments.
• Service Account Management - Manages non-human identities and API tokens for automated scanning and platform administration.
• Source and Dependency Vulnerability Scanners - Scans both source code and dependency manifests for security vulnerabilities in one pass.
• Source Code Vulnerability Scanning - Performs static analysis on application source code to detect security flaws.
• Command Line Scanners - Scans open-source code, application code, container images, and infrastructure files from a terminal.
• Continuous Repository Scanners - Continuously scans imported repositories for vulnerabilities and provides automated feedback during code review.
• Multi-Target Scanners - Scans dependencies, source code, container images, infrastructure configurations, and live APIs for vulnerabilities.
• Ruby Static Analysis - Scans Ruby source files for security vulnerabilities using cross-file static analysis.
• Rust Source Code Scanners - Analyzes Rust source code for security vulnerabilities using static analysis.
• Scala Source Code Scanners - Performs static analysis on Scala source code to detect security vulnerabilities.
• Swift and Objective-C Source Code Scanners - Scans Swift and Objective-C source code for security vulnerabilities.
• TypeScript Security Scanners - Analyzes TypeScript source code for security vulnerabilities using static analysis.
• Static Analysis Security Testing - Performs static analysis on proprietary source code to detect injection flaws, secret leaks, and other security vulnerabilities.
• Vulnerability Monitoring Systems - Continuously tracks projects for new vulnerabilities and alerts when issues are discovered.
• Vulnerability Scanning - Tests infrastructure configuration files such as Terraform and YAML for security misconfigurations and vulnerabilities.
• Container Image Vulnerability Scanners - Scans container images and Kubernetes manifests for known OS and application-layer vulnerabilities.
• Vulnerability Retesters - Periodically rescans default branches and alerts on newly discovered vulnerabilities.
• Dependency Resolution Engines - Parses manifest and lockfiles to construct transitive dependency graphs for vulnerability matching and SBOM generation.
• Vulnerability Prioritization - Prioritizes vulnerabilities using risk scores, severity, and exploit maturity to focus remediation.
• Software Bill of Materials Generators - Generates a complete software bill of materials from project dependencies for vulnerability testing.
• Static Analysis Engines - Performs cross-file data flow analysis on source code to detect injection flaws and secret leaks.
• Security Severity Build Gates - Fails CI/CD builds when vulnerability severity exceeds configurable policy thresholds.
• Outbound-Only Repository Proxies - Deploys a proxy that maintains outbound connections to enable scanning of isolated private repositories.
• IaC Security - Analyzes IaC configuration files before deployment to prevent security misconfigurations from reaching production.
• Web Vulnerability Scanning - Discovers and tests APIs and web applications for security vulnerabilities, including GraphQL endpoints.
• Dependency Health Dashboards - Uploads scan results to a dashboard for ongoing tracking of dependency health and license compliance.
• Programmatic Platform Management - Configures organizations, users, SSO, and reporting through programmatic commands instead of the web dashboard.
• Scan Result Exporters - Outputs scan results as JSON or SARIF for seamless integration into CI/CD pipelines.
• CVE Metadata Filters - Filters scan results by risk score, EPSS, CISA KEV, and other metadata for targeted remediation.
• IDE Integrated Tooling - Runs automated security checks during development inside IDEs, build pipelines, and code repositories.
• Security Scanning Plugins - Integrates scanning into IDEs and offers package selection recommendations to catch vulnerabilities during development.
• IDE Real-time Feedback - Performs real-time vulnerability scanning within the code editor as the developer writes code.
• Container Image Scanning - Inspects container images and Kubernetes manifests for known vulnerabilities and misconfigurations.
• TypeScript SBOM Utilities - Generates and tests SBOMs from TypeScript projects for vulnerability detection.
• SCM Security Importers - Connects a source control manager to automatically scan imported repositories for security vulnerabilities.
• Pip Project Scanners - Scans Python Pip projects by analyzing requirements.txt files with native pip tooling for vulnerabilities.
• Security Policy Gates - Tests code changes submitted via pull requests against security policies and blocks merges that introduce new vulnerabilities.
• Vulnerability Merge Gates - Prevents merging code that introduces new security vulnerabilities by running automated checks in pull or merge requests.
• Vulnerability Pre-Merge Gates - Scans open-source dependencies on each pull request or merge check and blocks new vulnerabilities from being introduced.
• Vulnerability Validation Gates - Scans each pull request for newly introduced vulnerabilities and blocks merging when policy thresholds are exceeded.
• Vulnerability Review Scanners - Scans open-source dependencies and code changes in pull requests for security issues and displays results during review.
• Scan Configurations - Defines analysis behaviors and patch specifications via policy files to control scan outcomes.
• GitLab Broker Proxies - Deploy a Docker container that securely proxies requests between the vulnerability scanner and your GitLab instance.
• Container Registry Scanning - Imports and monitors container images from registries for known vulnerabilities on a recurring schedule.
• Helm-Based Secure Proxy Deployments - Deploy a secure proxy client using Helm to link a private source code management system to a scanning platform.
• Runtime Vulnerability Monitors - Continuously tracks the dependency state of running applications through Kubernetes integration.
• Scan Result Browsers - Applies customizable rules to include or exclude security issues from scan output by severity or type.
• Vulnerability Suppressions - Suppresses vulnerabilities from future scans with justifications and optional expiration dates.
• Vulnerability Ticket Creators - Automates remediation workflows by creating tickets for vulnerabilities and managing ignores.
• Bill of Materials Vulnerability Tests - Tests software and AI bills of materials against vulnerability databases and policies.
• C/C++ Source Code Security Analysis - Analyzes C/C++ source code directly to detect security flaws and vulnerabilities.
• License Compliance Tools - Verifies dependency licenses against a database to identify compliance risks.
• Machine-Readable Vulnerability Exports - Exports vulnerability findings as JSON or SARIF for pipeline integration and custom tooling.
• OAuth 2.0 Authorization Flows - Creates service accounts using OAuth 2.0 client credentials flow for automated, short-lived access tokens.
• Docker-Based Scanning Proxies - Establish a secure bridge between a security scanning platform and a remote repository service, enabling vulnerability scanning via a Docker container.
• Project Attribute Taggers - Tags projects with custom attributes for filtering and grouping into focused collections.
• Dart and Flutter Dependency Scanners - Scans and monitors Dart and Flutter package dependencies for vulnerabilities, including native platform dependencies.
• Elixir Hex Dependency Scanners - Scans Hex dependencies in Elixir (Mix) projects for known security vulnerabilities, including transitive dependencies.
• Go Dependency Scanners - Resolves dependency trees for Go projects using Go Modules or dep and identifies known security vulnerabilities.
• Gradle Dependency Scanners - Scans dependencies declared in build.gradle or build.gradle.kts to identify vulnerabilities in build configurations.
• Java Dependency Scanners - Scans dependencies in Maven and Gradle projects using build files and lockfiles, including production scopes and optionally dev dependencies.
• JavaScript Dependency Tree Scanners - Analyzes dependency trees from package.json and lockfiles to identify known security vulnerabilities, even when no lockfile exists.
• JavaScript Scanning Configurations - Provides configurable rules for scanning JavaScript projects, including dev dependency handling and lockfile management.
• Pipenv Project Scanners - Scans Python Pipenv projects by analyzing Pipfile and Pipfile.lock files using native pipenv tooling.
• Poetry Project Scanners - Scans Python Poetry projects by inspecting pyproject.toml and poetry.lock files for dependency vulnerabilities.
• Software Bill of Materials Scanners - Scans software bill of materials files for known component vulnerabilities.
• Security Report Generation - Produces reports summarizing security posture, including vulnerabilities and license issues.
• Interactive Scan Reports - Transforms raw security scan data into a shareable interactive document for team review.
• Helm-Based Broker Deployments - Install a secure proxy via Helm to securely bridge a self-hosted server with a scanning platform for vulnerability scanning.
• SBOM Inspectors - Generates and tests software bills of materials from project manifests to identify vulnerable components.
• Dart and Flutter Source Code Analyzers - Scans Dart source code for security vulnerabilities using static analysis, covering popular frameworks and libraries.
• Go Source Code Analyzers - Performs static analysis across Go source files, including interfile analysis, to detect security vulnerabilities.
• Groovy Source Code Analyzers - Scans Groovy source code and its supported frameworks for security vulnerabilities using code analysis and interfile analysis.
• Repository Import Scanners - Imports code repositories via SCM integrations, CLI, or API to enable continuous security scanning and vulnerability detection.
• Base Image Security Scanners - Tests container base images in registries to ensure derived containers start from a secure foundation.
• Vulnerability Report Generation - Generates detailed reports and dashboards from scan results for tracking vulnerability coverage and remediation.
• Severity-Grouped Reviews - Reviews scan results grouped by severity and provides actions to fix identified issues.
• SBOM Vulnerability Testers - Tests software bills of materials using PURL references to detect known vulnerabilities in listed packages.
• Compliance Reporting - Generates reports for standards like OWASP Top 10, PCI-DSS, and CVSS v4.0.
• Critical Issue Gating - Integrates vulnerability scanning into the build pipeline and fails the build when critical issues are detected.
• Project Metadata Tags - Applies metadata labels to projects for filtering and reporting within an organization.
• Remediation Tracking - Tracks vulnerability remediation progress across projects with reports on open and resolved issues.
• Elixir SBOM Testers - Tests the Software Bill of Materials of Elixir packages using pkg:hex PURLs to identify vulnerabilities.
• Software Bill of Materials Testers - Tests SBOM files for Go projects and other ecosystems against vulnerability databases.
• Policy-Based Gates - Fails build checks in CI/CD pipelines when the project's vulnerability score violates configured policies.
• GitHub Repository Proxies - Set up a Docker-based proxy that securely connects a scanning platform to a GitHub repository for automated security analysis.
• Security and Compliance - CLI for identifying known vulnerabilities in dependencies.

Star history