Snyk CLI Documentation

When a patch is available for a vulnerability, Snyk modifies your project to apply the patch automatically during installation. The process involves:

1. Adding a patch entry to your .snyk file.
2. Adding @snyk/protect to your package.json dependencies.
3. Adding @snyk/protect to your package.json prepare script.

Once configured, running npm install will trigger @snyk/protect to download and apply the patches defined in your .snyk file to your installed dependencies.

 {
   "name": "my-project",
   "scripts": {
+    "prepare": "npm run snyk-protect",
+    "snyk-protect": "snyk-protect"
   },
   "dependencies": {
+    "@snyk/protect": "^1.657.0"
   }
 }

The snyk iac rules push command bundles rules written in Rego and uploads them to the Snyk platform.

Note: This feature is currently in Early Access.

Use the snyk container sbom command to generate a Software Bill of Materials (SBOM) for a container image. This includes both operating system and application dependencies.

Prerequisites:

• This feature is in Early Access and requires a Snyk Enterprise plan.
• Minimum CLI version: 1.1226.0.
• Requires an internet connection.

Supported Formats:

• CycloneDX v1.4 (JSON or XML)
• CycloneDX v1.5 (JSON or XML)
• CycloneDX v1.6 (JSON or XML)
• SPDX v2.3 (JSON)

The snyk config command manages your local Snyk CLI configuration file. This file is a JSON object located at $XDG_CONFIG_HOME/configstore/snyk.json or ~/.config/configstore/snyk.json.

Note: This command manages CLI settings and does not manage the .snyk project policy file. For project policies, use snyk policy or snyk ignore.

snyk config <SUBCOMMAND> [<OPTIONS>]

To begin using the Snyk CLI to scan and monitor your projects for security vulnerabilities and license issues, follow these three steps:

1. Authenticate: Connect the CLI to your Snyk account using snyk auth.
2. Test: Scan your local project for vulnerabilities using snyk test.
3. Monitor: Set up continuous monitoring and alerts for new vulnerabilities using snyk monitor.

The snyk redteam command performs an experimental adversarial scan against AI models and applications. It probes for vulnerabilities like model jailbreaking, prompt injections, and sensitive information disclosure.

Warning: This feature is experimental, potentially disruptive, and subject to breaking changes. Always use test data, test credentials, and target dev/staging environments rather than production. Avoid testing on applications that trigger costly or disruptive actions (e.g., sending emails or invoking expensive APIs).

Prerequisites:

• An internet connection.
• A preview version of the Snyk CLI.
• Authentication via snyk auth.

$ snyk redteam --experimental [<OPTION>]

When reporting vulnerabilities to Snyk, you are expected to adhere to the following responsible disclosure policy:

• Allow investigation time: Give Snyk reasonable time to investigate and mitigate the issue before making any information public or sharing it with others.
• Respect user privacy: Do not interact with individual accounts (including accessing or modifying data) without the account owner's consent.
• Avoid disruption: Make a good faith effort to avoid privacy violations and service disruptions, such as data destruction or service degradation.
• No exploitation: Do not exploit the discovered security issue for any reason, including demonstrating additional risk through attempted compromises or probing for further issues.
• Legal compliance: Do not violate any applicable laws or regulations.

To build the Snyk CLI distribution specifically for Docker Desktop on macOS, you must run the build script from the root of the workspace (one directory above the docker-desktop directory). The build process generates a tarball containing a signed NodeJS executable that allows Docker Desktop to execute the Snyk CLI JavaScript build.

Build Command: Run the following from the workspace root:

./docker-desktop/build.sh darwin x64

Output Location: The resulting tarball will be located at: ./binary-releases/snyk-for-docker-desktop-darwin-x64.tar.gz