Snyk
Developer-first SCA, SAST, container and IaC scanning.
Scorecard from 0 structured reviews
Exposure signal
LowAn objective, third-party reading of this vendor's own credential hygiene. It is not part of the community scorecard and does not affect any rating on DBSE.
Credentials belonging to 4 of this vendor's own staff appear in infostealer logs, and the most recent staff credential appeared 7 months ago. Their staff hold credentials for 0 distinct external services, which is the surface a successful attack on this vendor could reach. This says nothing about how well the product works.
Customer-side infections: 258 (not counted in the band)
These are infections on the machines of people who log in to this vendor's service. They reflect those users' own endpoint hygiene, and a vendor with a large consumer or partner login footprint will always show more of them. Counting that against the vendor would penalise popularity, so this platform does not.
Source: FireIntel (xti.fireintel.net), public domain summary. Source: Hudson Rock (hudsonrock.com), free infostealer intelligence API. About this data. Read 1 month ago, and due a refresh. DBSE does not collect, hold, or sell this data.
Public vulnerability record
9 CVEs across 5 productsWhat the public CVE catalogue holds against this vendor's products. A higher number here is not a worse vendor, and this is scored into nothing at all.
| Product | Catalogued under | CVEs |
|---|---|---|
| Snyk cli | Snyk | 5 |
| Advisor | Snyk | 1 |
| Service broker | Snyk | 1 |
| Kubernetes monitor | Snyk | 1 |
| Snyk cocoapods cli | Snyk | 1 |
Why this is shown and not scored
Counting CVEs punishes the vendors who tell you about them. A company that runs a bug bounty, works with researchers and files CVEs properly will always show more than one that fixes things quietly in a point release. Reading the bigger number as the worse product gets it exactly backwards.
The count also tracks how much software a vendor ships and how long they have shipped it. A vendor with forty products will out-score a vendor with one, whatever either does about security.
And a zero here usually means "not in this catalogue", not "no vulnerabilities found". Absence of a record is not a clean record.
What the list is genuinely good for is specifics: whether the product you are buying appears, and what has been disclosed about it. That is a question for the vendor in a security review, and their answer tells you more than the number does.
Matched in the catalogue as Snyk. Matching is by name, so it can pick up a namesake or miss a brand filed differently.
Source: CVEFeed (cvefeed.io), public CVE catalogue. About this data. Read 1 month ago. It is not part of the community scorecard, the star rating, or the exposure signal.
Discussions about Snyk
- No threads yet. Start one.