Product Updates

What Changed?

You can now set how often Snyk scans your repositories for secrets using Repo Monitor Configuration .

In "Inventory -> repository -> Settings" or in bulk via "Inventory -> Configure Monitoring", choose Daily, Weekly or Never for Secrets. Set it for a single repository or for many repositories at once.

Secrets also now appear in Inventory. In the All Assets view, each repository shows its Secrets coverage control, the Snyk Projects that contain Secrets results, and the Secrets issues found.

Prerequisites

• Repo Monitor Configuration (EA) enabled via Snyk Preview (for Secrets test configurations)

What Changed?

When you submit an ignore request under Ignore Approval Workflow, the issue now shows a clear "Pending Ignore Request" status directly on the Project's Issues page and in the issue details — so you can see at a glance that a request is awaiting review, instead of it looking like any other open issue.

You can also filter your Issues list to show only findings with a pending ignore request, making it easy to see and act on the queue of requests awaiting a decision without scanning every issue.

For API and integration users, the issues API now reports pending as part of an issue's ignore status, so you can distinguish open, pending, and ignored findings programmatically.

This enhancement will be rolled out gradually during the next 2 weeks.

Why we changed it?

Previously, a finding with a submitted-but-not-yet-approved ignore request looked identical to any other open issue.

There was no way to tell that a request was already in pending — which meant developers had no way to check whether their request had registered, and reviewers had no way to see pending requests from the view they already use to triage issues.

What does it mean to you?

If your organization uses Ignore Approval Workflow, pending ignore requests now appear automatically in the Issues page and issue details after your next scan — no configuration needed. The Pending Ignore filter is available alongside the existing Open and Ignored filters. No action is required to adopt this change.

Additional Information about Ignore Approval Workflow

https://docs.snyk.io/scan-fix-and-prevent/fix/prioritize-issues-for-fixing/ignore-issues/ignore-approval-workflow

We are pleased to announce the latest stable Snyk CLI release, v1.1308.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• HTML Reports

  • snyk code test and snyk secrets test can now generate an HTML report. Use --html to print it to stdout, or --html-file-output=<path> to write it to a file. This replaces the need for a separate snyk-to-html tool in most cases. Support for snyk test will be available in v1.1308.1.

• Agent Scan (experimental)

  • The experimental snyk agent-scan command now reports risk indicators instead of issue codes. If you post-process its --json output, update your scripts to the new format.

• Additional Reliability and Performance Improvements

  • Maven and Gradle SBOMs, and --print-graph, no longer stall on large multi-module builds and now finish seconds after the build tool exits. On projects with dependency cycles, the output may contain extra pruned: cyclic placeholder nodes. No packages or dependency edges are dropped.

  • Gradle projects with very deep inter-module dependency chains no longer fail with a stack overflow.

  • Projects built with Gradle 4.0 to 4.6 no longer fail to scan.

  • .NET scans fall back to legacy scanning when the .NET SDK isn't installed. They also handle projects restored in a different build directory, and work when global NuGet source-mapping rules are configured.

  • .NET scans no longer fail with NU1101 on SDK installs that lack the app host pack, such as distro-packaged SDKs.

  • .NET projects whose PackageReference uses a lowercase version attribute are now parsed correctly.

  • Updates dependencies to fix vulnerabilities

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

We are pleased to announce the latest stable Snyk CLI release, v1.1307.0.

We are introducing the following key improvements in this version. To learn more about bug fixes and additional enhancements beyond what is highlighted below, please reference the full release notes.

This update includes the following:

• Secrets

  • snyk secrets test now supports exclusions — add files or paths to the exclude section of your .snyk file to skip them during secrets scanning.

• Container

  • Container scans now surface image provenance attestations by default, so signed-image provenance metadata appears in results without any extra flag.

• .NET/NuGet

  • snyk test can now analyze already-restored .NET/NuGet projects fully offline and no longer requires .NET 6 to be installed.

• MCP

  • The full Snyk MCP profile now includes Snyk Secrets.

• Code & Secrets

  • SARIF suppressions now include reviewedOn and reviewedBy metadata.

• AI BOM

  • snyk aibom test --severity-threshold now filters the displayed and JSON results by severity, not only the exit code.

• Agent-optimized CLI

  • New experimental snyk agent command space — a scanning surface built for AI coding agents, with token-optimized output and ergonomics. snyk agent test runs Snyk Open Source, Code, and Secrets together.

• Additional Reliability and Performance Improvements

  • Adds support for scanning pnpm v11 pnpm-lock.yaml lockfiles.

  • Fixes a crash when scanning dependencies of Gradle 7.4–8.2 projects.

  • Fixes a bug where arguments after -- (for example snyk test . -- -s settings.xml) were treated as scan targets, which could silently drop the Risk Score.

  • Fixes scanning of projects using Hex versions newer than 1.19.

  • Excludes the .git folder from file discovery, preventing intermittent scan failures caused by changes to .git contents during a scan

  • Prevents a possible connection leak when the Snyk API returns an error response.

  • Updates dependencies to fix vulnerabilities.

Release notes can be found here.

If you have any questions, feel free to reach out to the Snyk support team. We encourage everyone to upgrade to the latest version to take advantage of these new features and improvements.

Starting August 4, 2026, Snyk secrets scanner is generally available to help secure your entire SDLC against credential leaks.

Stolen credentials remain a leading initial access vector in security breaches, and the rise of AI-generated code increases the risk of exposing sensitive data. You can now use Snyk secrets scanner to detect hardcoded credentials, API keys, and tokens across your repositories and prevent them from reaching commits or being leaked.

Key capabilities include:

• Machine learning driven detection and prevention across your development surfaces.

• Secrets detection for both human-written and AI-generated code.

• Governance and finding management directly within the Snyk web UI.

For more information, please read the blog and Snyk Secrets documentation

Until now, a developer could suppress a Snyk Code finding on their own — directly in the Web UI or IDE — with no review step.

Suppression happened silently and unilaterally, leaving security teams without a gate on what got ignored.

Ignore Approval Workflow changes that.

An ignore is no longer applied automatically — it becomes a request that only takes effect after a reviewer approves it. Developers submit ignores from where they work; a reviewer approves or rejects from the web; both sides are notified of the outcome. Suppression moves from an ungoverned action to a reviewed, auditable one.

What you can do

• Submit ignore requests from the CLI, IDE, or API — a reason is required, and the ignore is created as Pending rather than applied.

• Review from the web — reviewers with the review permission approve or reject on the Ignore Requests page.

• Auto-approve your own — reviewers can bypass triage for ignores they create themselves.

• Stay notified — reviewers are emailed on new requests and requesters on the outcome.

• Control access with roles — read / create / edit / review / delete permissions; by default Collaborators request and Admins review, with custom roles supported.

• Audit everything — export ignore-request data via the audit-logs API.

We are thrilled to announce that the Prevention Report is now available in Early Access!

Measuring the true impact of "shifting left" has traditionally been a challenge. We designed the Prevention report to give you clear, actionable visibility into the effectiveness of security adoption directly within your development lifecycle.

This new report tracks the vulnerabilities developers proactively remediate at the point of creation in Snyk Code and Secrets—long before those issues ever reach a pull request or production environment. Data is seamlessly captured in the background as your team works across our developer surfaces, including Snyk Studio (MCP), IDE plugins and extensions, and the CLI.

The Prevention report enables you to:

• Measure proactive security: Track the total number of raw fixes and monitor your fix rate over time using our new prevention key performance indicators (KPIs).

• Analyze developer workflows: Break down fixes by surface area to understand exactly where your team prefers to resolve issues (MCP, IDE, or CLI).

• Identify trends and champions: Leverage the Fix-by-Developer leaderboard and detailed vulnerability breakdowns to see which types of vulnerabilities developers squash immediately, and which ones are detected but left unfixed.

• Enrich your Analytics Overview: Enable fix-by-surface KPIs and a new fix trends chart directly within your primary Analytics Overview dashboard for a comprehensive view of your security posture.

You can now directly measure the effectiveness of your IDE or MCP-based security efforts. By tracking vulnerabilities remediated early in the development lifecycle, you gain the data needed to prove the success of your security programs and validate your application security strategy.

To learn more, visit our Snyk User Documentation.