Do I need a Snyk account to use the CLI with servasec?

Yes. The Snyk CLI requires authentication with a Snyk account. However, you only need the free tier to generate SARIF output that can be pushed to servasec.

Can I use Snyk's proprietary vulnerability database with servasec?

Snyk's vulnerability data is included in the SARIF output. servasec ingests the full findings including CVE IDs, severity, and fix recommendations from Snyk.

Supported/SCA

Snyk + servasec

Developer security platform for finding and fixing vulnerabilities in open source dependencies and containers.

What is Snyk?

Snyk is a developer-first security platform that helps find and fix vulnerabilities in code, open source dependencies, containers, and infrastructure as code. While Snyk offers its own platform, its CLI can output SARIF results that can be ingested into servasec for teams that want centralized ASPM alongside other scanners.

Vulnerability database with fix adviceLicense compliance scanningContainer vulnerability scanningIaC security scanningDeveloper-friendly CLI

Integrate Snyk with servasec

Install Snyk CLI

Install Snyk via npm or the official installer.

npm install -g snyk

Run a test

Test your project for vulnerabilities and output SARIF.

snyk test --sarif-file-output=results.sarif

Push to servasec

Send the SARIF results to servasec.

curl -X POST "$SSC_PUBLIC_URL/api/ingest" \
  -H "X-Api-Token: $API_TOKEN" \
  -F "[email protected]"

What servasec adds to Snyk

Multi-scanner view

See Snyk findings alongside Semgrep SAST and Trivy container results.

Cross-scanner correlation

Correlate Snyk dependency issues with SAST findings in the same code.

Trend analysis

Track vulnerability counts over time across all your projects.

Try Snyk with servasec

Self-host servasec and connect Snyk in minutes. AGPLv3 licensed, full data ownership.