Snyk CLI commands are more than just a shortcut; they’re the primary interface for integrating Snyk’s security intelligence directly into your development workflow.
Let’s see Snyk in action. Imagine you’ve just pulled down a new project.
# First, navigate to your project directory
cd /path/to/my/project
# Then, run a full scan to find vulnerabilities, license issues, and IaC misconfigurations
snyk test --all-sub-projects
This command does a lot. It enumerates your project’s dependencies (npm, Maven, pip, etc.), queries Snyk’s vulnerability database, and reports back any known issues. The --all-sub-projects flag is crucial for monorepos or projects with multiple distinct packages.
Snyk’s power lies in its ability to understand your project’s context. It doesn’t just look at a package-lock.json; it understands the transitive nature of dependencies and maps them to known CVEs.
Here’s a breakdown of common use cases and their corresponding commands:
1. Initial Project Scan
This is your first line of defense. It tells you what’s wrong right now.
snyk test
- What it does: Scans your project’s dependencies for known vulnerabilities and license compliance issues.
- Why it matters: Identifies immediate risks in your current codebase.
- Output: A report detailing vulnerable dependencies, severity, and paths to remediation.
2. Monitoring for Continuous Security
Once you’ve fixed issues, you want to ensure new ones don’t creep in.
snyk monitor
- What it does: Scans your project and then uploads the results to Snyk’s cloud for continuous monitoring. It will alert you if new vulnerabilities are found in the monitored dependencies.
- Why it matters: Provides ongoing visibility into your project’s security posture, alerting you to newly disclosed vulnerabilities affecting your dependencies.
- Setup: Requires
snyk monitor --file=<path/to/manifest>if Snyk can’t auto-detect your manifest file.
3. Fixing Vulnerabilities
Snyk doesn’t just tell you about problems; it helps you fix them.
snyk wizard
- What it does: Interactively guides you through fixing vulnerabilities by suggesting and applying upgrades or patches.
- Why it matters: Automates the process of updating dependencies to secure versions, reducing manual effort and the risk of introducing errors.
- Usage: Follow the prompts. It will often ask if you want to upgrade a dependency to the minimum version that fixes the vulnerability.
4. Scanning Infrastructure as Code (IaC)
Modern applications rely on cloud infrastructure, which has its own set of security risks.
snyk iac test
- What it does: Scans your IaC files (Terraform, CloudFormation, Kubernetes manifests, etc.) for security misconfigurations.
- Why it matters: Cloud misconfigurations are a leading cause of breaches. This command finds issues like publicly exposed S3 buckets or overly permissive IAM roles.
- Configuration: For specific directories, use
snyk iac test /path/to/iac/files.
5. Integrating with CI/CD Pipelines
Security needs to be part of your automated build process.
snyk test --json --fail-on=high
- What it does: Performs a test and outputs results in JSON format. The
--fail-on=highflag causes the command to exit with a non-zero status code if any high-severity vulnerabilities are found. - Why it matters: Allows you to integrate Snyk into your CI/CD pipeline to automatically fail builds that introduce critical vulnerabilities.
- CI/CD Example: In a GitHub Actions workflow, you might have a step like:
snyk test --fail-on=high || echo "Snyk scan failed"
6. Working with Docker Images
Container security is paramount.
snyk container test <your-docker-image>:<tag>
- What it does: Analyzes your Docker image layers for OS-level and application-level vulnerabilities.
- Why it matters: Identifies risks within your containerized applications, from vulnerable base images to installed packages.
- Local Image Scan: If the image is built locally, Snyk will detect it. For remote registries, ensure you’re authenticated.
7. Managing Snyk Projects
Beyond scanning, you can manage your Snyk projects directly.
snyk ignore --id=<VULN_ID> --reason="False positive" --expiry=<date>
- What it does: Creates or updates an
.snykpolicy file to ignore specific vulnerabilities. - Why it matters: Useful for known vulnerabilities that are out of your control or deemed acceptable risks, preventing them from cluttering reports.
- Note: Use with caution; ignoring vulnerabilities should be a deliberate decision.
Snyk’s CLI is designed to be flexible, allowing you to tailor its output and behavior to fit various development and CI/CD workflows. The --json flag is particularly powerful for programmatic integration.
When you first start using Snyk, you might be surprised by the sheer number of vulnerabilities reported. It’s common to see dozens, if not hundreds, of issues stemming from transitive dependencies. The key is to prioritize based on severity and exploitability, using the snyk wizard or snyk upgrade commands to address the most critical ones first.
The next step after getting your dependencies clean is often to look at the security of your custom code itself, which is where Snyk Code comes into play.