Let's Play Snyk 🐶
Tags: devops, devsecops, security, opensource
Published: 2024-03-06 16:56:56

Hi folks, I'm diving into [Snyk](https://snyk.io/) this time. This is a platform for developer security that helps protect infrastructure as code, dependencies, containers, and code. Snyk includes the following products and mostly focuses on security and dependency monitoring:

![Snyk Plans](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/flrfxctew10xy6jhsg0c.png)

## [**Snyk Code**](https://snyk.io/product/snyk-code/)

- **Static application security testing (SAST):** helps developers find and fix vulnerabilities in their code as they write it. This offers real-time scanning, fix advice, broad language and platform support, machine learning engine, risk prioritization, and workflow integration. 

![How Snyk shows vulnerabilities in code](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/gw9eri0qa38z3gldd2n0.png)

- **Features:** Secure code without disrupting development workflow, save time and money by preventing code delays and security issues, and become quasi-security professionals with comprehensive security tooling and knowledge.

## [**Snyk Open Source**](https://snyk.io/product/open-source-security-management/) 

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/zsf7e970ppi7mhwzui24.png) [_source_](https://www.google.com/url?sa=i&url=https%3A%2F%2Fwww.youtube.com%2Fwatch%3Fv%3D4ng5usM6fd8&psig=AOvVaw1x14K5isWMgtEHwQrdWPMQ&ust=1709829513164000&source=images&cd=vfe&opi=89978449&ved=0CBMQjRxqFwoTCOi30buJ4IQDFQAAAAAdAAAAABAD)

- **What is Snyk Open Source?** Software composition analysis (SCA) solution that helps developers find and fix security vulnerabilities and license issues in open source dependencies. 
- **How does it work 🤔** Integrates with various developer tools, scans open source packages and dependencies for vulnerabilities and license issues, providing actionable advice and automated workflows for fixing them. 
- **Why use it?** Enables developers to secure open source code using industry-leading security and application intelligence, reducing risk and ensuring compliance with regulatory and internal security policies.

## [**Snyk Container**](https://snyk.io/product/container-vulnerability-management/) 

- **What is Snyk Container?** Developer-first solution that helps find, prioritize, and fix vulnerabilities in container images and Kubernetes workloads throughout the software development lifecycle.

![Snyk Container Preview](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/wk4148vsh38wnmm7wmhn.png) [_Source_](https://www.google.com/url?sa=i&url=https%3A%2F%2Fsnyk.io%2Fblog%2Ftips-best-practices-building-secure-container-images%2F&psig=AOvVaw1_CdvdqcB6f0kA9Qxwitvx&ust=1709829852629000&source=images&cd=vfe&opi=89978449&ved=0CBMQjRxqFwoTCKjdmtuK4IQDFQAAAAAdAAAAABAD)


- **How does Snyk Container work?** Snyk Container integrates with daily developers' tools, scans for vulnerabilities in base images, dependencies, Dockerfile commands, and Kubernetes manifests, provides remediation advice, recommendations, and priority scoring.
- **Why use Snyk Container?** Snyk Container allows developers to secure containers and Kubernetes workloads without disrupting daily workflows, thereby saving development time, reducing security risks, and achieving compliance objectives.

## [**Snyk Infrastructure as Code**](https://snyk.io/product/infrastructure-as-code-security/) 

- **What is Snyk IaC?** Snyk IaC is a tool that helps developers secure their infrastructure as code (IaC) configurations from code to cloud. It scans IaC files for vulnerabilities and misconfigurations, provides remediation advice and fixes, and detects drift in running cloud environments.

![Snyk IaC preview](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/b44szwblz0lw046mdtzr.png)

Snyk IaC integrates with developer workflows, providing security feedback and suggested fixes. It enforces consistent security and compliance rules across SDLC and cloud using OPA's Rego query language. It enables proactive security issue fixation and unifies visibility and governance across multiple IaC frameworks and cloud providers.

## [**Snyk AppRisk**](https://snyk.io/product/snyk-apprisk/)

- **What's Snyk AppRisk**: A solution that helps teams **build, deploy, and operate securely** in the cloud by embedding security in developer workflows from code to cloud.

![Snyk AppRisk preview](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/tej1jp4c9ytrs44x0d25.png) [_source_](https://www.google.com/url?sa=i&url=https%3A%2F%2Fsnyk.io%2Fblog%2Fcritical-webp-0-day-cve-2023-4863%2F&psig=AOvVaw3F51I_RHVisXXiWZJ3xdwv&ust=1709830381461000&source=images&cd=vfe&opi=89978449&ved=0CBMQjRxqFwoTCJj-4NuM4IQDFQAAAAAdAAAAABAD)

- **Key Features**: Snyk AppRisk provides security feedback and fixes for **code, dependencies, container images, and cloud infrastructure as code (IaC)** across the software development life cycle (SDLC) and running cloud environments.
- **Benefits**: Snyk AppRisk enables developers to **proactively fix security issues** in their IDE, CLI, and Git workflows, reducing backlogs and time to fix. It also **unifies visibility and governance** from code to cloud with a single policy engine and ruleset, and **speeds up and scales** developer-led fixes for cloud misconfigurations with direct links to the source IaC file in Git workflows.
- **Supported Technologies**: **Terraform, CloudFormation, ARM, Kubernetes, Docker, AWS, Azure, Google Cloud**, and more. It also integrates with **Sysdig** for runtime security and **OPA** for policy enforcement.

Before we go any farther, I need to volunteer to tackle two key difficulties that you could be having 😉
- What's the meaning of Snyk?
- How to pronounce this word 👀 
This [Snyk support](https://support.snyk.io/hc/en-us/articles/360000890358-How-do-you-pronounce-Snyk#:~:text=Snyk%20is%20short%20for%20'So%20Now%20You%20Know'.) provides answers

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/vrsoj9mpumsrfpj6cq2m.png)

## **Let's use Snyk**

There're couple of ways we can use Snyk
- You can install [Snyk CLI](https://docs.snyk.io/snyk-cli/getting-started-with-the-snyk-cli) using terminal, and scan your project using Snyk

![Image description](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ez86iuybp9p15ytj793z.png)


- [IDE Plugins](https://docs.snyk.io/integrate-with-snyk/ide-tools) - my main IDE is VSCode, but you can also use Snyk in Jetbrains IDEs, Eclipse and Visual Studio 

![Snyk VSCode plugin preview](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/r9i9o9slnze6otis6inf.png)


![after the installation how it previews](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/99w5ghjyftuimwaz6rfv.png)

- [Git Repositories](https://docs.snyk.io/integrate-with-snyk/git-repositories-scms-integrations-with-snyk) - GitHub, Bitbucket, Gitlab and Azure (TFS). From these GitHub and Bitbucket integrations are popular. For this you have to login with your relevant account

![login with git repository integration](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/x1vxv2h74ti7260ya2rt.png)

after you add github repositories to Snyk, you can see vulnerabilities in each repository Snyk dashboard's projects section

![Snyk dashboard projects](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/ruyqb6b7nm60k6phenxt.png)

You can check each security vulnerability, in each project by going inside, and it'll show like this:


![Security vulnerabilities in a project](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/03r4gt6f0v6dtmwohqco.png)

Settings allows you to adjust git repository Snyk configurations. This has an incredible collection of capabilities, that you may setup Snyk automated pull requests for repositories, enable Snyk scan for manual pull requests, activate Snyk for code, activate Snyk for IaC. Check your Snyk Usage (If you're using the Snyk free plan like me, you can see how much resource you've used). Snyk may be integrated with your existing notification system, such as Slack. 

Here's a Snyk-bot's automatic pull request on GitHub repository

![Snyk-bot's automatic pull request on GitHub repository](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/1pv6yo4pbynslbxo1goa.png)

You can change Snyk configurations to check your repository code, IaC weekly due to limited resources in your plan.

Furthermore, you can add Snyk app to your GitHub account from the [marketplace](https://github.com/marketplace/snyk): 

![Snyk app](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/5l7ce53kpo8sgq67bhbt.png)


- [Snyk for CI/CD](https://docs.snyk.io/integrate-with-snyk/snyk-ci-cd-integrations) - Pipelines and integrations in AWS, Azure, Bitbucket and more


![Snyk for CI/CD](https://dev-to-uploads.s3.amazonaws.com/uploads/articles/i050ze91uiga99c6b3j4.png) [_Image source_](https://www.google.com/url?sa=i&url=https%3A%2F%2Fsnyk.io%2Fblog%2Ffind-fix-vulnerabilities-ci-cd-pipeline-snyk-harness%2F&psig=AOvVaw2rfI3gcDfVsFzu0LxUyms9&ust=1709827966046000&source=images&cd=vfe&opi=89978449&ved=0CBUQjhxqFwoTCJDYk9iD4IQDFQAAAAAdAAAAABAD)