Snyk Projects now stay in sync with your repository content
The "What"
Repo Content Sync keeps your Snyk Projects aligned with what your repositories actually contain. When a change is merged to a branch Snyk monitors, Snyk creates and begins monitoring Projects for newly added manifest, Dockerfile, and configuration files, and deactivates the Projects whose files were removed. A file that is moved or renamed is picked up at its new path, and the Project at the old path is deactivated.
Until now, keeping Snyk in step with a repository was a manual step: someone re-imported the repository, or a newly added dependency file simply went unscanned. Repo Content Sync makes repository content itself the trigger, so your Project list reflects the code as it is today rather than as it was at import.
Sync covers Code, open source, secrets, infrastructure as code, and container (Dockerfile) Projects, and it works on custom branches as well as default branches.
Repo Content Sync will be rolled out gradually over the next several weeks.
The "Why"
A Snyk Project is a point-in-time snapshot of a repository. The moment a developer adds a manifest, a Dockerfile, or an infrastructure-as-code config — or removes one, or renames it — Snyk's view of that repository is out of date, and closing the gap depends on someone remembering to re-import.
The cost lands on both sides of that gap. Coverage decays quietly between imports, so a security team cannot tell the difference between a repository that is clean and one that was never looked at. And when a source file is deleted, its Project lingers as a stale asset, inflating inventory and issue counts that someone then has to explain.
Repo Content Sync removes the manual step. Coverage follows the repository, so what Snyk monitors and what your developers merge stay in step on their own.
The "How"
Repo Content Sync is on by default for organizations on an Enterprise plan. There is nothing to enable and no configuration to change. It is rolling out to Enterprise organizations, so it may reach your organizations over the following weeks. If you already turned it on through Snyk Preview, it stays on and nothing changes for you.
Once it reaches an organization, your Project list moves with your repositories: Projects appear as new scannable files are merged, and Projects are deactivated when their files are removed. Inventory and issue counts shift to match.
Considerations and known limitations:
A Project you deactivate yourself, through the UI or the API, is not reactivated by sync — manual deactivation is respected.
If you delete a Project and want it to stay deleted, select the option to exclude it from future scans in the delete dialog; without that, a Project whose source file still exists can be recreated on the next sync.
Upon GA, if some projects were previously deleted but not removed from SCM, they might reappear and will require a 'permanent' deletion via the option to 'exclude it from future scans.'
For more information check Repo Content Sync Docs