Features
Everything it does, and where each part stops
30 capabilities, grouped by what they are for. Every one of these pages ends with a section saying what that feature does not do, because a feature list that only lists strengths is an advertisement rather than a description.
Finding things
Secret scanning
Three engines over every commit on every branch, not just the current one.
Limit It reads. It cannot revoke a key, and it will never try: revoking is a write into somebody else's account and getting it wrong takes a production service down.
Read moreLive credential verification
Ask the provider whether the key still works, before anybody panics.
Limit Only covers providers that publish a way to check.
Read moreStatic analysis
semgrep across thirteen rule packs, with a second engine where it helps.
Limit Free semgrep reads one file at a time.
Read moreDependency vulnerabilities
grype and OSV over a real SBOM, not a guess at the manifest.
Limit The vulnerability data is public: OSV, the GitHub advisory database and the NVD.
Read moreReachability
Which vulnerable packages the application can actually call.
Limit A heuristic, and it says so.
Read moreMalicious packages
Typosquats, install hooks and the OpenSSF advisory feed.
Limit The offline signals are suspicions and are graded as suspicions.
Read moreInfrastructure as code
Terraform, Kubernetes, Dockerfiles and the CI pipeline itself.
Limit Snyk IaC has more rules and better remediation text, and has cloud context this does not have at all.
Read moreContainer images
The base image every Dockerfile names, read without building it.
Limit Off by default, because it downloads images.
Read moreSBOMs and licenses
CycloneDX and SPDX with a real dependency graph, kept after the scan.
Limit License detection is as good as the metadata.
Read moreDeep history, finished
A history too large for one run is walked across several, until it ends.
Limit Only worth turning on for a repository that does not finish.
Read moreMaking it usable
Triage rules
What counts as an example rather than a credential, and who decided.
Limit A rule here hides findings estate wide with no expiry.
Read moreRecommended severity
The tool says when its own grade is probably too high.
Limit It will not soften a malicious package or a verified credential, whatever else is true about them.
Read moreAI validation that learns
A model reads the finding and the code, lowers what it should, and the scanner remembers why.
Limit A model can be wrong, and it can be misled by something written in the code it reads, which is why it may only lower, never on a credential or a known exploi...
Read moreExclusions and exceptions
Decisions with a reason, a reviewer and an expiry.
Limit An exclusion with no expiry is permanent until somebody notices.
Read moreSeverity as you mean it
A plain HTTP link is not a medium everywhere, and a grade is usually about a combination.
Limit A regrade is a judgement.
Read moreCertified branches
A person signs off a branch, or a completed scan signs off the ones with nothing to read.
Limit A green badge is read as "this is safe" by everybody who sees it, and that is not what anybody certified.
Read moreBaselines
Draw a line on a date and work forward from it.
Limit A baseline is a way of managing attention, not a way of fixing anything.
Read moreBlast radius
Who can reach each repository, and what it holds.
Limit The access inventory needs a credential that can read organization membership.
Read moreSoftware inventory
Every package, every version, every branch it sits on. Searchable.
Limit It only knows what a scan collected, so a repository last scanned with SBOMs switched off is not in it, and the page says how much has been collected rather ...
Read moreCutting the noise
Sixty one per cent of an estate moved out of the work list, with a count and a way back.
Limit The claim is not that any of this is wrong.
Read moreFitting in
Twelve hosting providers
GitHub, GitLab, Bitbucket, Gitea, Forgejo, Azure Repos, Subversion and more.
Limit AWS and Google both closed their hosting to new customers in 2024, so those two are for accounts that already have repositories in them.
Read moreNotifications
Slack, Teams, mail and a plain webhook, on what is new.
Limit It notifies. It does not open the ticket, and Snyk does.
Read morePipelines and SARIF
Fail a build, or upload findings to a Security tab.
Limit It is a command and a schema rather than a polished integration.
Read moreIn your editor
VS Code, Cursor, JetBrains and Eclipse, from your own server.
Limit The plugin is not on any marketplace, so an editor will not update it for you: a new release means downloading it again from the page.
Read moreThe editor API
Review a file before it is committed.
Limit It reviews what you send it and nothing more.
Read moreVEX documents
Answer "your product contains a vulnerable library" in a file.
Limit It is only as good as the decisions behind it.
Read moreTrends and the PDF report
Whether the numbers are moving, a risk matrix, and a document to send upstairs.
Limit History starts when the scanning does, so a repository scanned for the first time yesterday has a short chart.
Read moreReports and exports
JSON, CSV, SARIF, both SBOM formats and an audit trail of every decision.
Limit Nothing here is scheduled: a report is written when a scan runs or when somebody asks for one, and there is no way to have one mailed out every Monday.
Read moreWhat each account scans
Branches per connection, picked from the names past scans found.
Limit The two limits meant for large estates, the cap per repository and the stale branch cutoff, stay global.
Read moreScanning at scale
What a scan may take from the machine, and what it keeps when it is stopped.
Limit It is one server. Scans run alongside each other up to a limit you set, and there is no second machine to hand work to.
Read moreThe honest version is on the comparison page
Forty capabilities scored against Snyk, GitHub Advanced Security, Semgrep, Checkmarx One and GitGuardian, with the reasoning for every row and no attempt to hide the ones that go the other way.