Snyk Code

---
name: snyk-code
description: "Expert agent for Snyk Code AI-powered SAST. Covers DeepCode engine, real-time IDE scanning, data-flow analysis, auto-fix suggestions, Priority Score, and Snyk platform integration. WHEN: \"Snyk Code\", \"Snyk SAST\", \"DeepCode\", \"Snyk IDE plugin\", \"snyk code test\", \"Snyk Priority Score\", \"Snyk fix\", \"Snyk AppRisk\"."
license: MIT
---

# Snyk Code

This skill covers Snyk Code, Snyk's AI-powered SAST solution. You understand the DeepCode engine, Snyk's unified security platform, Priority Score, and how Snyk Code integrates with the broader Snyk ecosystem (Snyk Open Source, Snyk Container, Snyk IaC).

## How to Approach Tasks

1. **Identify the interface:** IDE plugin, CLI (`snyk code test`), CI/CD, or Snyk Web UI.
2. **Identify the task:** Running scans, understanding findings, fixing vulnerabilities, IDE setup, CI/CD integration, Priority Score interpretation.
3. **Consider the platform context:** Snyk Code is one engine in the Snyk platform. Often the user is using Snyk OSS (SCA) as well — cross-reference when relevant.

## DeepCode Engine

Snyk Code is powered by the DeepCode engine, which Snyk acquired in 2020. DeepCode combines:

**Symbolic AI:** Rule-based analysis using semantic understanding of code. Creates a code graph with type information, data flows, and control flows.

**Machine Learning:** Trained on millions of open-source repositories. Uses ML to:
- Reduce false positives (learned from developer feedback patterns)
- Identify vulnerability patterns that are hard to express as rules
- Generate fix suggestions by learning from how developers fixed similar issues

**Hybrid approach advantage:** Better balance of coverage (ML catches novel patterns) and precision (symbolic AI reduces noise) compared to either approach alone.

### Analysis Capabilities

- **Intra-file data flow:** Tracks taint within a single file
- **Inter-file data flow:** Traces taint across function calls between files (requires full project analysis)
- **Framework-aware:** Understands Django, Flask, Express, Spring, Rails, etc. Sources and sinks are framework-specific.
- **Real-time (IDE):** Analysis runs incrementally as you type. Results appear without a full scan.

### Supported Languages

10+ languages with varying depth:
- **Deep analysis:** JavaScript, TypeScript, Python, Java, C#, PHP, Go, Ruby
- **Standard analysis:** Kotlin, Swift, Scala, Apex

Framework support spans major web frameworks for each language.

---

## Running Snyk Code

### CLI

```bash
# Install Snyk CLI
npm install -g snyk
# or: brew install snyk

# Authenticate
snyk auth

# Run Snyk Code SAST
snyk code test

# Scan specific directory
snyk code test ./src

# Output in SARIF format
snyk code test --sarif > snyk-code.sarif

# Output in JSON
snyk code test --json > snyk-code.json

# Fail on severity threshold
snyk code test --severity-threshold=high
```

**Exit codes:**
- 0: Success, no issues found at or above threshold
- 1: Vulnerabilities found at or above threshold
- 2: Failure (e.g., authentication error, network issue)

### IDE Plugins

Snyk Code is available as IDE plugins with real-time scanning:

**VS Code:**
- Install: "Snyk Security" extension from VS Code marketplace
- Authentication via OAuth
- Findings appear as inline annotations (squiggly lines with hover details)
- "Snyk Code" tab shows full project findings
- Fix suggestions shown inline for supported rules

**IntelliJ IDEA / JetBrains IDEs:**
- Install: "Snyk Security" plugin from JetBrains marketplace
- Same real-time feedback model
- Works in IDEA, WebStorm, PyCharm, GoLand, Rider, etc.

**Eclipse and Visual Studio:** Available via Snyk extension.

**Real-time feedback loop:**
As a developer types code that matches a vulnerability pattern, Snyk Code annotates the issue immediately. This is the earliest possible shift-left — finding issues before saving the file.

---

## Understanding Snyk Code Findings

### Finding Anatomy

Each finding includes:
- **Rule name:** e.g., "SQL Injection" or "Cross-site Scripting"
- **CWE:** Mapped CWE ID
- **OWASP category:** OWASP Top 10 2021 mapping
- **Data flow:** Visual path from source to sink (in IDE and Web UI)
- **Priority Score:** Snyk-specific risk score (0-1000)
- **Example fix:** Code suggestion from learned patterns

### Data Flow Visualization

Snyk Code shows the complete path from user input to vulnerable sink:

```
Source: req.params.userId [app.js:24]
  → Parameter passed to getUserData() [app.js:24]
  → Received as userId parameter [database.js:12]
  → Used in SQL string concatenation [database.js:15]
Sink: db.query(sql) [database.js:15]
```

This helps developers understand why a finding is flagged, not just where.

### Priority Score

Snyk Priority Score (0-1000) combines multiple signals:

| Signal | Weight | Description |
|---|---|---|
| CVSS severity | High | Base vulnerability severity |
| Exploit maturity | High | Is a working exploit known? |
| Reachability | High | Is the vulnerable code actually called? |
| Fixability | Medium | Is a fix available? |
| Social trends | Low | Community discussion/attention |

**Priority Score interpretation:**
- 900-1000: Fix immediately (critical + exploitable + reachable)
- 700-899: Fix this sprint
- 500-699: Fix in near-term backlog
- < 500: Informational, track in backlog

This scoring helps teams focus on what matters rather than raw vulnerability count.

---

## Auto-Fix Suggestions

Snyk Code provides auto-fix suggestions for many vulnerability types, generated by AI (trained on open-source fix patterns).

**Supported fix types:**
- SQL injection: Replace string concatenation with parameterized queries
- XSS: Add output encoding
- Path traversal: Add path validation
- Hardcoded credentials: Move to environment variable / secrets manager
- Insecure random: Replace `Math.random()` with `crypto.randomBytes()`

**Fix quality note:** AI-generated fixes are suggestions, not guaranteed correct code. Always review before applying. Fixes may need adjustment for:
- Specific ORM/framework APIs in your codebase
- Variable naming and existing patterns
- Error handling requirements

**Applying fixes:**
- In IDE: Click "Fix this issue" in the annotation popup
- In Web UI: View suggested fix, copy to clipboard or apply via PR
- Via API: Snyk can create fix PRs automatically

---

## CI/CD Integration

### GitHub Actions

```yaml
- name: Snyk Code Scan
  uses: snyk/actions/node@master   # or python, java, golang, etc.
  continue-on-error: true  # Allow SARIF upload even if scan fails
  env:
    SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
  with:
    command: code test
    args: --sarif-file-output=snyk-code.sarif

- name: Upload Snyk Code SARIF
  uses: github/codeql-action/upload-sarif@v3
  with:
    sarif_file: snyk-code.sarif
```

### GitLab CI

```yaml
snyk-code:
  image: snyk/snyk:node
  script:
    - snyk auth $SNYK_TOKEN
    - snyk code test --json > snyk-code.json || true
  artifacts:
    paths:
      - snyk-code.json
```

### Jenkins

```groovy
stage('Snyk Code Scan') {
  steps {
    snykSecurity(
      snykInstallation: 'snyk@latest',
      snykTokenId: 'snyk-token',
      additionalArguments: 'code test --severity-threshold=high'
    )
  }
}
```

### Quality Gate Pattern

Use `--severity-threshold` to control pipeline gating:

```bash
# Fail pipeline only on critical/high
snyk code test --severity-threshold=high

# Fail on any finding
snyk code test --severity-threshold=low

# Never fail pipeline (informational only)
snyk code test || true
```

---

## Snyk Platform Integration

### Unified AppSec View

Snyk Code is one component of the Snyk security platform. A complete Snyk deployment includes:

| Product | Coverage |
|---|---|
| Snyk Code | SAST (source code) |
| Snyk Open Source | SCA (dependencies) |
| Snyk Container | Container image scanning |
| Snyk IaC | Infrastructure as code |
| Snyk AppRisk | Asset management, ASPM |

**Snyk AppRisk (Application Security Posture Management):**
Aggregates findings across all Snyk products with:
- Application inventory (discover all apps)
- Risk-based prioritization across SAST + SCA + Container
- Policy engine (define what counts as "acceptable risk")
- Coverage reporting (which apps are scanned by which tools)

### Organization and Project Structure

```
Snyk Organization
├── Projects (auto-discovered from SCM)
│   ├── Code analysis (Snyk Code results)
│   ├── Open source (Snyk OSS results)
│   └── Infrastructure (Snyk IaC results)
└── Integrations
    ├── SCM (GitHub/GitLab/Bitbucket/Azure)
    ├── CI/CD (Jenkins/CircleCI/GitHub Actions)
    └── IDE (VS Code/JetBrains)
```

### Ignoring Issues

**Via CLI:**
```bash
snyk ignore --id=snyk-code/CWE-89 --expiry=2026-06-01 --reason="Reviewed: input validated upstream"
```

**Via `.snyk` file (committed to repo):**
```yaml
# .snyk
version: v1.25.0
ignore:
  snyk-code/CWE-89:
    - '*':
        reason: Input validated by framework middleware
        expires: 2026-06-01
```

**Via Snyk Web UI:** Mark issue as "Ignored" with reason and expiry. Persists in Snyk, visible in audit log.

---

## Common Issues and Troubleshooting

**Snyk Code not finding issues it should:**
- Check supported language — Snyk Code requires supported frameworks for framework-aware analysis
- Ensure `snyk auth` completed successfully (token is valid)
- For private repos: ensure SCM integration has read access to the repository

**Too many false positives:**
- Use Priority Score to filter: focus on 700+ first
- Review data flow — is the source actually user-controlled in your context?
- Use ignore mechanism with documented reason (not suppression for its own sake)

**IDE plugin not showing real-time results:**
- Check authentication status in plugin settings
- Ensure project was opened from root directory (not a subdirectory)
- Some languages require a build/dependency resolution step first

**SARIF output empty:**
- `snyk code test` returns exit code 1 when findings exist; use `|| true` to prevent stopping the pipeline before SARIF upload
- Check that `--sarif-file-output` path is writable

**Slow CI scans:**
- Use `--detection-depth` to limit recursive directory scanning
- Exclude test directories: add `--exclude=test,spec,__tests__` to avoid scanning test code