Product Updates

Starting November 11, 2026, Snyk API & Web’s Azure DevOps Boards integration authenticates through Microsoft Entra ID instead of Azure DevOps OAuth. Nothing changes in how you use the integration. Only the sign-in and token handling behind it are replaced.

Microsoft is retiring Azure DevOps OAuth on December 1, 2026. Moving to Entra ID keeps your integration working after that date.

If your Snyk API & Web account has the Azure DevOps Boards integration setup, you’ll need to reconnect it once, by November 30, 2026.

Reconnecting keeps your existing setup. Your target settings, the links between findings and Azure DevOps work items, and the work items already created are all preserved. You don’t need to reconnect individual targets.

To keep your setup intact, select Reconnect, not Delete, and keep the same Azure DevOps organization. Deleting the integration or changing the organization removes all target connections, and you’d have to set them up again.

What Changed?

You can now set how often Snyk scans your repositories for secrets using Repo Monitor Configuration .

In "Inventory -> repository -> Settings" or in bulk via "Inventory -> Configure Monitoring", choose Daily, Weekly or Never for Secrets. Set it for a single repository or for many repositories at once.

Secrets also now appear in Inventory. In the All Assets view, each repository shows its Secrets coverage control, the Snyk Projects that contain Secrets results, and the Secrets issues found.

Prerequisites

• Repo Monitor Configuration (EA) enabled via Snyk Preview (for Secrets test configurations)

What Changed?

When you submit an ignore request under Ignore Approval Workflow, the issue now shows a clear "Pending Ignore Request" status directly on the Project's Issues page and in the issue details — so you can see at a glance that a request is awaiting review, instead of it looking like any other open issue.

You can also filter your Issues list to show only findings with a pending ignore request, making it easy to see and act on the queue of requests awaiting a decision without scanning every issue.

For API and integration users, the issues API now reports pending as part of an issue's ignore status, so you can distinguish open, pending, and ignored findings programmatically.

This enhancement will be rolled out gradually during the next 2 weeks.

Why we changed it?

Previously, a finding with a submitted-but-not-yet-approved ignore request looked identical to any other open issue.

There was no way to tell that a request was already in pending — which meant developers had no way to check whether their request had registered, and reviewers had no way to see pending requests from the view they already use to triage issues.

What does it mean to you?

If your organization uses Ignore Approval Workflow, pending ignore requests now appear automatically in the Issues page and issue details after your next scan — no configuration needed. The Pending Ignore filter is available alongside the existing Open and Ignored filters. No action is required to adopt this change.

Additional Information about Ignore Approval Workflow

https://docs.snyk.io/scan-fix-and-prevent/fix/prioritize-issues-for-fixing/ignore-issues/ignore-approval-workflow

This update will be available on October 26, 2026.

Snyk Code reports significantly more findings in this update. Affected projects will report the additional findings on their next scan.

Snyk Code now analyzes more deeply and more accurately in Java, Kotlin, Go, TypeScript, JavaScript, Python, C#, PHP and Ruby.

Go, TypeScript and JavaScript

Snyk Code reads the Project's own configuration to resolve imports. For Go, it reads go.mod, which defines the module path that a project's packages import each other through. For TypeScript and JavaScript, it reads tsconfig.json and jsconfig.json, which define path aliases.

As a result, Snyk Code now analyzes these projects more accurately and with greater depth.

PHP

Snyk Code corrects boolean typing in PHP analysis. Previously skipped findings now appear across cross-site scripting, path traversal, SQL injection and other checks.

Java

Coverage is added or improved for these libraries:

• Spring Data MongoDB

• AWS SDK for Java, DynamoDB

• AWS SDK for Java 2.x, DynamoDB

• AWS SDK for Java 2.x, DynamoDB Enhanced Client

• Apache Commons FileUpload

• Google Cloud Big Query

Snyk Code adds a Mass Assignment rule for Spring applications. It reports request data that binds directly onto a database entity. Path traversal detection is wider.

More detection

Snyk Code reports additional findings in these areas:

• Python: XML external entity injection.

• JavaScript: deserialization, XML external entity injection and zip slip.

• JavaScript, Bootbox: DOM-based cross-site scripting.

• JavaScript, d3: DOM-based cross-site scripting.

• C#: path traversal.

• Go: SQL injection.

• Go, AWS SDK for Go v2: path traversal through S3 object keys.

• Ruby: path traversal, and a new server-side request forgery rule.

Template file analysis and serverless analysis

Snyk Code analyzes template files and serverless applications more accurately and with greater depth, building on the September update. Both will yield additional findings in projects that use template engines or serverless frameworks.

Learn more in the Snyk Code documentation.

Starting August 18, 2026, a user's Evo data is limited to the Snyk Organizations they can read.

Until now, everyone with access to Evo saw every repository, asset, and issue in the Tenant. Evo now
reuses your existing Snyk Organization hierarchy, so there is nothing new to model and no migration to
run. Nobody loses access until an administrator changes their role.

What's new:

• Tenant Viewer now grants read access to the assets and issues in the Organizations the user belongs to, and to nothing outside them

• Tenant Member grants no Evo access, letting administrators withhold Evo without removing Snyk platform access

• Full-Tenant access continues for Tenant Admin and for the two roles ending in "with Evo access"

• Organization names appear alongside repositories, distinguishing the same repository imported into more than one Organization

Note for administrators:

Existing users keep their access, and Tenant Viewers gain scoped read access for the first time. New
users join as Tenant Member, which carries no Evo access, so each one needs a role change. Scoped
users are read only, and assets without an Organization stay hidden, which today means all Agent
Supply Chain Security and Continuous Offensive Security data.

Documentation: Access and authentication

Starting August 17, 2026, Evo by Snyk uses a rebuilt model risk score to evaluate the AI models discovered in your organization.

The previous Risk Index is replaced by a single score from 0–1,000 that combines attack success rate with the potential impact of a successful attack, tested against categories including prompt injection, data exfiltration, and insecure code generation. The result is a score that reflects both how easily a model can be compromised and how much damage that compromise could cause — not just whether an attack succeeded.

What's new:

• Impact-weighted scoring: Risk scores now factor in the real-world consequence of an attack succeeding, not only its likelihood.

• Four severity bands: Scores map to low (0–249), medium (250–499), high (500–749), and critical (750–1,000), so you can triage at a glance.

• Broader attack coverage: Testing spans a wider range of direct and indirect attack categories against each discovered model.

• Framework-mapped: Findings map to OWASP LLM Top 10, OWASP Agentic Security, MITRE ATLAS, and NIST AI 600-1/100-2e2025, so you can connect model risk to the compliance frameworks you already report against.

• Policy-ready from day one: Evo applies default policies across common attack categories automatically, and you can create custom policies scoped to specific attack categories or goals to match your organization's risk tolerance.

If you have policies built on the old Risk Index: those policies remain visible but no longer evaluate under the new scoring. Review and recreate any Risk Index-based policies against the new model risk score to keep enforcement active.

Read more in the Risk intelligence documentation.

Starting August 4, 2026, Snyk secrets scanner is generally available to help secure your entire SDLC against credential leaks.

Stolen credentials remain a leading initial access vector in security breaches, and the rise of AI-generated code increases the risk of exposing sensitive data. You can now use Snyk secrets scanner to detect hardcoded credentials, API keys, and tokens across your repositories and prevent them from reaching commits or being leaked.

Key capabilities include:

• Machine learning driven detection and prevention across your development surfaces.

• Secrets detection for both human-written and AI-generated code.

• Governance and finding management directly within the Snyk web UI.

For more information, please read the blog and Snyk Secrets documentation

Until now, a developer could suppress a Snyk Code finding on their own — directly in the Web UI or IDE — with no review step.

Suppression happened silently and unilaterally, leaving security teams without a gate on what got ignored.

Ignore Approval Workflow changes that.

An ignore is no longer applied automatically — it becomes a request that only takes effect after a reviewer approves it. Developers submit ignores from where they work; a reviewer approves or rejects from the web; both sides are notified of the outcome. Suppression moves from an ungoverned action to a reviewed, auditable one.

What you can do

• Submit ignore requests from the CLI, IDE, or API — a reason is required, and the ignore is created as Pending rather than applied.

• Review from the web — reviewers with the review permission approve or reject on the Ignore Requests page.

• Auto-approve your own — reviewers can bypass triage for ignores they create themselves.

• Stay notified — reviewers are emailed on new requests and requesters on the outcome.

• Control access with roles — read / create / edit / review / delete permissions; by default Collaborators request and Admins review, with custom roles supported.

• Audit everything — export ignore-request data via the audit-logs API.

We are introducing Automatic Target Authentication Configuration for API & Web, an AI-driven feature that streamlines DAST authenticated scan setup.

Scaling DAST across large application portfolios is often hindered by manual authentication tasks, such as recording login sequences, mapping CSS selectors, and configuring 2FA.

This feature eliminates manual hurdles by leveraging LLM automation:

• AI-powered mapping: Automatically generates login sequences and handles 2FA, allowing you to configure authenticated scans in minutes.

• Privacy first: Sensitive credentials are isolated in dedicated fields and are never processed by the LLM.

• Custom control: Refine the AI's behavior with natural-language instructions for complex login scenarios.

Visit the Help Center article to learn more about how it works and view current limitations.

Snyk API & Web now provides native support for Bruno collections. You can import your collections directly into the platform to create API Targets without converting files to Postman collections or OpenAPI schemas first.

For teams using Bruno, this update simplifies API targets setup with several key capabilities:

• Collection Imports: Upload Bruno collections directly using a ZIP file or folder.

• Environment Variable Syncing: Snyk uploads collection environments automatically. The platform scans the import and warns you if any variables are missing required secret values.

• Authentication Support: Use authentication types derived from the collection or custom authentication scripts.

For a step-by-step walkthrough on importing your first collection, refer to the article in our Help Center.