Product Updates

Starting November 11, 2026, Snyk API & Web’s Azure DevOps Boards integration authenticates through Microsoft Entra ID instead of Azure DevOps OAuth. Nothing changes in how you use the integration. Only the sign-in and token handling behind it are replaced.

Microsoft is retiring Azure DevOps OAuth on December 1, 2026. Moving to Entra ID keeps your integration working after that date.

If your Snyk API & Web account has the Azure DevOps Boards integration setup, you’ll need to reconnect it once, by November 30, 2026.

Reconnecting keeps your existing setup. Your target settings, the links between findings and Azure DevOps work items, and the work items already created are all preserved. You don’t need to reconnect individual targets.

To keep your setup intact, select Reconnect, not Delete, and keep the same Azure DevOps organization. Deleting the integration or changing the organization removes all target connections, and you’d have to set them up again.

Snyk API & Web now extends its security header, cookie attribute, and SSL/TLS checks to the Extra Hosts of a target. These checks, which include findings such as "HSTS header not enforced" and "Missing Content Security Policy header", already run against one endpoint of the target URL. As of today, each scan also runs them against one endpoint of every Extra Host configured on the target.

Targets often serve content from more than one host, and each of those hosts is part of the target's overall security posture. By applying these checks to every host configured on a target, each scan now gives you a fuller view of that posture.

With this change, scans of targets with Extra Hosts report security header, cookie attribute, and SSL/TLS findings for those hosts as well, giving you a more complete picture of the target. Because these hosts are now checked, you may see new findings on a target's next scan, even if nothing has changed on the target itself. There is nothing for you to set up: the checks apply automatically to every target with Extra Hosts configured.

If you have any questions about your scans, please reach out to Support.

Snyk API & Web now lets you upload your organization's internal Certificate Authority (CA), so the certificates it issues are trusted the same way as publicly issued certificates.

What's new

Many enterprises operate their own internal CA to issue certificates for both internal tools and internet-facing applications. Although these certificates aren't signed by a public CA, they should still be included in scans to prevent false positives.

What we're delivering

A method for uploading your Root CA. Each scan of every target then verifies certificates against your CA and the public trust store.

This increases scan accuracy, reduces the overhead of documenting risk acceptance for each affected target, and boosts the overall precision of each scan based on your specific needs and requirements.

Snyk API & Web now supports NTLM v2 authentication for Web targets. Security teams can configure NTLM credentials (username, password, domain, workstation) directly in the target settings, enabling authenticated scans of Windows-authenticated applications without requiring separate tools.

Many enterprise customers — especially in financial services, insurance, and government — run internal applications protected by NTLM authentication. Without this capability, these applications remained unscanned, creating security blind spots.

Security engineers can now scan Windows-authenticated internal applications that were previously inaccessible, eliminating coverage gaps. To configure NTLM authentication, navigate to Target Settings > Authentication tab, locate the Basic Auth / NTLM module, and select the NTLM option.

To learn more, visit NTLM in our user documentation.

We are introducing Automatic Target Authentication Configuration for API & Web, an AI-driven feature that streamlines DAST authenticated scan setup.

Scaling DAST across large application portfolios is often hindered by manual authentication tasks, such as recording login sequences, mapping CSS selectors, and configuring 2FA.

This feature eliminates manual hurdles by leveraging LLM automation:

• AI-powered mapping: Automatically generates login sequences and handles 2FA, allowing you to configure authenticated scans in minutes.

• Privacy first: Sensitive credentials are isolated in dedicated fields and are never processed by the LLM.

• Custom control: Refine the AI's behavior with natural-language instructions for complex login scenarios.

Visit the Help Center article to learn more about how it works and view current limitations.

Snyk API & Web now provides native support for Bruno collections. You can import your collections directly into the platform to create API Targets without converting files to Postman collections or OpenAPI schemas first.

For teams using Bruno, this update simplifies API targets setup with several key capabilities:

• Collection Imports: Upload Bruno collections directly using a ZIP file or folder.

• Environment Variable Syncing: Snyk uploads collection environments automatically. The platform scans the import and warns you if any variables are missing required secret values.

• Authentication Support: Use authentication types derived from the collection or custom authentication scripts.

For a step-by-step walkthrough on importing your first collection, refer to the article in our Help Center.

Snyk API & Web now supports the OWASP Top 10:2025 standard for compliance reporting. Users can generate compliance reports against either OWASP 2025 or OWASP 2021 — both versions remain available.

The OWASP Top 10 is the most widely referenced application security framework globally. It's used by enterprises for compliance programs, audit preparation, security training, and vulnerability prioritization.

The OWASP Top 10:2025 was officially published in November 2025 and is being adopted by enterprises, auditors, and compliance programs now. Organizations need their security tools to support the current standard for audit-ready compliance reports.

Without 2025 support, compliance teams face manual workarounds — exporting findings to spreadsheets and cross-referencing against the new standard — a time-consuming and error-prone process.

What changed in OWASP Top 10 2025:

• Two new categories: A03 (Software Supply Chain Failures) and A10 (Mishandling of Exceptional Conditions)

• Re-ranked categories: Security Misconfiguration moved from #5 to #2; Injection dropped from #3 to #5; Cryptographic Failures dropped from #2 to #4

• SSRF reclassification: Server-Side Request Forgery is now classified under A01 (Broken Access Control) instead of having its own category

You can now generate compliance reports against either OWASP 2025 or OWASP 2021 directly from the Snyk API & Web interface — both versions remain available.

How to use:

1. From the Scan Activity list or from your Scan details, click on the Reports button to expand it

2. Select the OWASP version you need:

   • OWASP Top 10 2025 — for audits, compliance programs, or reporting against the current standard

   • OWASP Top 10 2021 — for historical comparisons or programs that haven't migrated to the 2025 edition yet

3. Generate your report — all findings are automatically mapped to the selected standard

What you'll see:

• Compliance reports are clearly labeled with the selected OWASP version

• Versioned compliance labels throughout the product (target details, scan details, finding details) show which standard a finding is failing to comply with (e.g., OWASP 2025, OWASP 2021)

To learn more, visit Types of scan reports you can generate with Snyk API & Web in our user documentation.

We've improved the recently introduced Download CSV feature to offer greater flexibility when exporting data directly from the Snyk API & Web interface.

We understand that analyzing security data often happens outside of our platform. The original Download CSV functionality was added to save you time and streamline custom reporting and internal data manipulation. This expansion provides even more power and flexibility by allowing you to select from a comprehensive range of fields, ensuring you get exactly the data you need for your external analysis.

This feature is available to all users across all account plans. If you have access to a table, you can download its data.

To learn more, visit How to export table data to CSV in our user documentation.

We’ve expanded our DAST capabilities by adding GraphQL as a supported API target type in Snyk API & Web. This enables security tests specifically designed for GraphQL operations, including queries and mutations. In addition to schema ingestion via URL or file upload, you can now fetch your schema directly from an introspection endpoint to ensure tests stay up to date. To support these scans, we've also updated our authentication settings to include dedicated options for GraphQL targets.

To learn more, visit How to configure and scan an API and How to set target authentication: GraphQL in our user documentation.

We added a new Test configuration option to the Scan dropdown menu and the Target Settings page. This allows you to verify that your target is accessible and correctly configured before starting a full dynamic application security testing (DAST) scan. When you click this button, a side panel opens in your target settings to provide real-time feedback on connectivity, authentication, web application firewall (WAF) interference, schema validity, and any detected extra hosts.

We want to simplify your onboarding experience and prevent failed scans caused by misconfigured settings. By validating your setup upfront, we help you identify and fix issues immediately, reducing the need for troubleshooting or technical support later in the process.

You can now proactively test your target configuration. To use this feature, ensure you have the view_target, change_target_settings, and start_scan permissions.

To learn more, visit How to test target configuration in our user documentation.