Snyk Reviews

What do you like best about Snyk?For our .NET work, Snyk became much more useful once we stopped treating security as something that happens after development. Snyk Open Source integrates well with NuGet and Paket, understands project.assets.json, solutions, and project files, and can generate Fix PRs for supported NuGet dependencies. That alone saves us from discovering vulnerable packages during a later audit, when the person who introduced the dependency may not even be on the same project anymore. We also use Snyk Code for SAST across C# and VB.NET. In one review, it traced a request value through several methods until it reached a database query that didn’t have enough sanitization. Being able to see the full source-to-sink path was far more useful than a generic “possible SQL injection” warning that gives no clue how the value got there. Inter-file analysis is especially important in .NET because the risky part rarely lives in the same method where the input first enters the application. In CI, we run snyk test and snyk code test, and the IDE plugin catches many issues before a pull request even exists. That combination has done more for adoption than any security dashboard. Developers respond much better when a finding shows up right next to the code they’re already changing, instead of arriving three weeks later in a spreadsheet from another team.What do you dislike about Snyk?Some dependency setups require pinning explicit versions to get Fix PRs to work. Also, packages-lock.json isn’t supported by Snyk Open Source, and legacy projects may fall back to static resolution, where private dependencies or build-specific behavior are harder to capture accurately. None of this has stopped us from using the tool, but older solutions still need more manual verification than modern SDK-style projects. I’d like the gap between a current ASP.NET Core service and a mixed legacy repository to be smaller, especially when both live in the same organization and are expected to follow the same security policy.What problems is Snyk solving and how is that benefiting you?We ran into this trade-off during a release of an ASP.NET Core billing service, right after several NuGet upgrades and a container base-image change. Snyk Open Source flagged a critical vulnerability in a transitive dependency and indicated that an indirect package update could remove it. At the same time, Snyk Code identified an unsafe data flow in a new endpoint, and Snyk Container surfaced vulnerable packages inherited from the base image. Our first instinct was to stop the release entirely, which would have been the safe-looking answer but not necessarily the right one. We reviewed reachability and the actual execution path and determined that one finding couldn’t be reached from our application configuration, while the other two represented real exposure. We upgraded the package, switched the base image, fixed the endpoint, and reran the pipeline before deployment. Afterward, we kept the same checks on pull requests so these issues would be caught closer to the change, instead of turning into another release-day surprise. Snyk gave us enough context across code, dependencies, and containers to tell the difference between something that can be scheduled and something that truly needs to block production.

What do you like best about Snyk?Snyk stands out because it keeps application security simple and developer-friendly by integrating directly into the development workflow. It not only identifies vulnerabilities across code, dependencies, and containers, but also offers clear, automated fixes that help teams resolve issues faster and build secure software from the start.What do you dislike about Snyk?Snyk can sometimes produce false positives and generate too many alerts, which can overwhelm teams and force a lot of manual validation. It can also become expensive at scale, and some areas especially documentation and integrations could use improvement.Recommendations to others considering Snyk?Snyk addresses the problem of late-stage and fragmented security in development by integrating security checks directly into the developer workflow. Rather than discovering vulnerabilities after deployment, it surfaces issues earlier across code, open-source dependencies, and containers, and it provides clear remediation guidance. What problems is Snyk solving and how is that benefiting you?

What do you like best about Snyk?It provides clear visibility into the code that’s deployed, which helps us understand what’s running and ensures it meets our desired security standards.What do you dislike about Snyk?The auto-imports and overall cost, including open-source scanning, don’t feel optimised. Also, the results contains false positives which can create ambiguityWhat problems is Snyk solving and how is that benefiting you?It can be beneficial because it alerts me when new CVEs are published, and it also suggests solutions for the vulnerabilities it identifies.

What do you like best about Snyk?What I like best about Snyk is how it integrates security into the developer workflow without disrupting it. The VS Code and JetBrains plugins give real-time vulnerability feedback as I write code, cutting remediation time significantly. Instead of just flagging a CVE, Snyk tells you exactly which version to upgrade to and often opens a fix PR automatically, saving hours of manual cross-referencing. The dependency graph makes transitive vulnerabilities easy to understand, and the reachability analysis means we focus on what's genuinely exploitable rather than drowning in false positives. What do you dislike about Snyk?Performance-wise, scans run fast even on large monorepos, and the dashboard stays responsive without lag, it never feels like a bottleneck in the CI pipeline. Recommendations to others considering Snyk?On pricing and ROI, the value becomes clear quickly. Catching vulnerabilities pre-deployment rather than post-production saves significant incident response costs, and the free tier is generous enough for smaller teams to see real value before committing. Onboarding was smooth too, connecting GitHub repos took minutes and gave us an immediate risk picture. It feels like a security tool built for developers, which makes adoption across engineering teams much easier.What problems is Snyk solving and how is that benefiting you?A few friction points stand out. The noise from low-severity vulnerabilities can be overwhelming, especially on larger projects, while prioritization helps, tuning the filters to fit your specific risk tolerance takes time and trial and error. The licensing issue detection, though useful, sometimes flags things that aren't actually a concern in your use case, adding to that noise.

What do you like best about Snyk?Snyk is easy to set up and start using. Setting it up to run as a GitHub Action allows it to integrate seamlessly alongside other existing CI processes. Along with this, I like that its vulnerability scanning is pretty much universally trusted amongst engineers, this trust allows for peace of mind.What do you dislike about Snyk?This might have changed since the last time I worked with this product, but at the time Snyk was a bit expensive compared to similar products.What problems is Snyk solving and how is that benefiting you?Snyk makes it easy to stay informed about possible vaulneabilities in software and it's dependencies. Snyk's dependency vulnerability scanning is particularly valuable since in most cases downstream dependencies are numerous and more difficult to audit than an applications main code. Warnings and alerts produced Snyk are prompt and trustworthy.

What do you like best about Snyk?Snyk has an extensive and up-to-date vulnerability database which helps early detection of vulnerabilities in applications. It is very developer friendly with easy integration set-up and descriptive remediation advice for detected vulnerabilities. I use it daily running in CI/CD pipelines.What do you dislike about Snyk?Sometimes it flags false positives. Scans can take a few minutes for a medium sized repository which can slow down pipeline.What problems is Snyk solving and how is that benefiting you?Snyk scans repositories for security vulnerabilities in code and also its dependencies. Catches the vulnerabilities early before deploying to codebase.

What do you like best about Snyk?Its Scanning capabilities are very Good. For instance, it really does well in SAST scans and even SCA scans. It is also helpful in mitigating vulnerabilities by providing the best solutionsWhat do you dislike about Snyk?It’s cost. It is very expensive. Other than that, The UI can be a bit betterWhat problems is Snyk solving and how is that benefiting you?Snyk tackles the challenge of spotting and fixing security vulnerabilities across your software stack—everything from open‑source libraries and container images to infrastructure‑as‑code and your own codebase. It fits right into your workflow (think GitHub, IDEs, CI/CD), so you catch real issues early and get actionable fixes automatically. This means fewer surprises, faster development, and stronger confidence that security isn’t slowing you down—it’s built in.

What do you like best about Snyk?Recently they came with feature called, Deep code AI, using this we can fix the issue for 1st party cod in IDE levelWhat do you dislike about Snyk?It doesnt have On-prem, And also we cannot push the SAST results to the Dashboard from CLIWhat problems is Snyk solving and how is that benefiting you?Snyk is covering from code to cloud and back to code.

What do you like best about Snyk?I think it is so easy to use. I like that it includes solutions to the issues I have, it can quickly scan a codebase and will constantly scan it. We had no issues including it into our code base.What do you dislike about Snyk?The solutions sometimes overlap and don't coincide. Another issue I could say would be pricing.What problems is Snyk solving and how is that benefiting you?We have had some security issues in the code base we never would have realized without it.