Snyk test

snyk test

Analyze project dependencies with Snyk (SCA), detecting known package vulnerabilities and licenses.

Run it in the CI/CD pipeline when you want dependency analysis: snyk test queries Snyk's Vulnerability Database with the project's dependency tree and reports findings — packages with CVEs, severity, available fix (safe version), and licenses. It's the reference commercial SCA: dependency vulnerability detected with the fix. In DevSecOps, Snyk is the pipeline piece (with the same flow for code and containers): high-severity findings block the merge and the fix is applied.

Don't use it without an account: snyk test requires authentication (token) — check the free tier limits. And note: SCA detects known dependency vulnerabilities — code logic (SAST) and runtime (DAST) are out of scope. Snyk's database updates: new CVEs require re-scanning. Findings are triaged (dependencies not exploitable in the project context — reachability). For open-source SCA, use the manager's audit (npm audit, 020) or Grype (batch 20).