snyk.io updates app.snyk.io/projects

We are happy to update that exploit maturity information is also now available in Alpine, Ubuntu and Debian. Check out documentation to learn more!

Happy to share that we’ve just released a new version of the the Snyk Vulnerability Scanner plugin for IntelliJ!

The Snyk Vulnerability Scanner helps you find and fix security vulnerabilities and licence issues in your projects, all from within the IDE.

The new version is based on Snyk CLI and has an integral support for Gradle (in addition to Maven) and licenses.

To learn more about the the new version, visit the plugin page, at JetBrains marketplace.

We're continuing to expand our new infrastructure as code features, with support for detecting security misconfigurations in Helm Charts now available to all. See the blog post for all the details.

It's now possible to tag your projects via the API! 🎉 Project tags allow you to label your projects in any way you like, such as by team, risk status, or even the type of applications the projects are used by. You can then use the new API to filter all the projects that have the same tag.

For more information on how to use project tags, head on over to the documentation.

This feature will be available in the UI soon, but until then, happy tagging!

We have introduced several security fixes to our open source Broker. We’d like to thank Wing Chan of The Hut Group that responsibly disclosed the issues to us via our bug bounty program.

These issues pertained to increased privileges available to specific internal Snyk Personnel only. All issues were patched for all supported SCMs in version 4.80.0 of the Broker. We also have taken steps to improve the auditability of the Broker code, and have also improved both client and server-side logging in order to improve customer and Snyk visibility of activity on the service.

Happy to share that we've just released new APIs that will allow you to create new Git integrations and to “Brokerize” existing integrations without having to contact Snyk support 🎉

All Git integrations are supported: GitHub, GitHub Enterprise, BitBucket Cloud, BitBucket Server, GitLab and Azure Repos.

With the new set of APIs, you'll be able to:

1. Create new integration (Brokered / non Brokered)
2. "Brokerize" an existing integration
3. "Debrokerize" an existing integration

To find out more about the new endpoints, please take a look at our API docs:

• Add new integration

• Update existing integration

We are excited to share that starting today, Pro and Enterprise customers, can test, fix and monitor their Azure Repos Server projects for open source vulnerabilities.

In order to integrate your Azure Repos Server instance to Snyk, all you need to do is to go to the Integrations page and click on Azure Repos:

Once the Azure Repos integration settings page loads, you'll be asked to enter the URL of your on-premise Azure Repo Server instance along with the personal access token you've generated for Snyk:

After filling out these details correctly, you'll get a confirmation message ensuring that Snyk has successfully connected to Azure Repos and you'll be able to start importing projects to Snyk.

Please note that the new integration supports TFS v2018 Update 2 and above.

Snyk is thrilled to announce the new support for scanning application vulnerabilities in container images, alongside the operating system ones, all in a single scan.
If you have Node, Ruby, Python or PHP applications as part of your image, we can now surface their dependencies vulnerabilities as well during scan. To use this feature, you need to enable it in your container registry integration settings.

To learn more, check out our blog post and get started!

Snyk is excited to release the first phase of our shared policies functionality that we will be working on throughout 2020. With new and improved license policies, group administrators can now leverage Snyk to more easily manage and scale their license compliance throughout the SDLC.

Learn more about our developer-first approach to license compliance management on our blog and in our help center

We are pleased to announce we have added support for private Artifactory npm registries

Whether your Artifactory npm registry is hosted in the cloud or on your internal network, you can now update your settings to enable Snyk to access your private Node.js packages. This works for both npm and yarn projects.

Enabling this feature means Snyk can now re-lock yarn.lock files and update package-lock.json files more accurately when creating Fix Pull/Merge Requests.

To get started, check out the documentation!