performing-sca-dependency-scanning-with-snyk

# Performing SCA Dependency Scanning with Snyk ## When to Use - When applications use open-source packages that may contain known vulnerabilities - When compliance requires tracking and remediating vulnerable dependencies (PCI DSS, SOC 2) - When needing automated fix PRs for vulnerable dependencies in CI/CD - When license compliance requires visibility into open-source license obligations - When continuous monitoring is needed for newly disclosed vulnerabilities in deployed dependencies **Do not use** for scanning proprietary application code for logic vulnerabilities (use SAST), for runtime vulnerability detection (use DAST), or for container OS package scanning alone (use Trivy for a free alternative). ## Prerequisites - Snyk account (free tier covers up to 200 tests per month for open source) - Snyk CLI installed or Snyk GitHub/GitLab integration configured - SNYK_TOKEN environment variable set with API authentication token - Project with supported package manifests: package.json, requirements.txt, pom.xml, go.mod, Gemfile, etc. ## Workflow ### Step 1: Install and Authenticate Snyk CLI ```bash # Install Snyk CLI npm install -g snyk # Authenticate with Snyk snyk auth $SNYK_TOKEN # Test the connection snyk test --json | jq '.summary' ``` ### Step 2: Scan Dependencies in CI/CD Pipeline ```yaml # .github/workflows/dependency-scan.yml name: Dependency Security Scan on: push: branches: [main] pull_request: branches: [main] schedule: - cron: '0 8 * ...