Snyk Code

snyk code test

Scans the code with Snyk Code, detecting application vulnerabilities using Snyk's static analysis engine.

Run it in the CI/CD pipeline (or in the IDE) when you want Snyk's SAST: snyk code test analyzes the code (multi-language) with Snyk's engine (based on learning and rules) and reports findings with severity, CWE, and line. It's the commercial SAST with Snyk ecosystem integration: the same flow as SCA (snyk test) and container (snyk container). In DevSecOps, Snyk Code is the piece of Snyk's pipeline: code analysis on push with the pipeline gate.

Don't use it without an account: snyk code test requires authentication (snyk auth with token) and a Snyk account — the license (free tier with limits) is reviewed. And watch out: Snyk Code's engine detects vulnerabilities from its rules — domain-specific ones require manual analysis; and findings are triaged (false positives). Snyk's SAST complements SCA (019): code and dependencies are separate analyses. For deep semantic analysis, CodeQL; Snyk Code for ecosystem integration.