Snyk integration
Find out which Snyk Open Source and Snyk Code findings are exploitable in your code, with the evidence behind each verdict.
Integration details
Primary category
Software Composition Analysis
Sync direction
Snyk ↔ Konvu
Konvu pulls Snyk findings once a day and on demand. Once an admin activates ignores, dismissing an SCA finding in Konvu adds an ignore in Snyk.
Status
Available
Which Snyk findings can an attacker actually use?
A Snyk finding says a vulnerable package or a risky code pattern is present. Whether it can be exploited depends on how your application uses it. Konvu reads your Snyk Open Source and Snyk Code findings, checks each one against your source code, and returns a verdict with the evidence behind it. When your team dismisses a dependency finding in Konvu, Konvu adds the matching ignore in Snyk once an admin activates ignores for the connection.
One fintech SaaS company running Konvu on its Snyk SCA and SAST findings. Figures as reported in the case study.
81%
of Snyk findings flagged as false positives
50+
hours of manual Snyk triage saved per week
3x
faster remediation of critical vulnerabilities
Snyk findings Konvu analyzes
SCA
Snyk Open Source
Vulnerable open source dependencies, matched to the repository and manifest file Snyk scanned.
SAST
Snyk Code
Code findings from Snyk Code, imported on every sync with your dependency findings.
Container
Snyk Container
Optional. Container image findings are imported only when the container add-on is turned on for the connection.
Not imported today
- Snyk IaC and cloud findings
- License compliance issues
- Snyk projects without a manifest file, such as some CLI projects, unless they are mapped to a repository
Access and setup
Paste a Snyk API token once. Konvu uses it to register a Snyk App for your organization, then completes the connection through Snyk OAuth. Each Snyk organization is connected separately.
To read findings
org.readorg.project.readorg.project.snapshot.readorg.collection.readorg.project.ignore.read
To write back
org.project.ignore.createorg.project.ignore.delete- Both are requested in the same authorization as the read scopes. Konvu writes no ignores until an admin selects "Activate ignores from Konvu" on the connection.
- Konvu reads your code through your GitHub or GitLab connection, not through Snyk. Snyk targets are matched to repositories by URL.
How Konvu investigates Snyk findings
What Konvu receives
For Snyk Open Source: the package, version, vulnerability, and the manifest it came from. For Snyk Code: the flagged rule and its location in your code.
What Konvu checks
- Whether the vulnerable package is installed and loaded, and whether your runtime and configuration match what the vulnerability needs.
- Whether the vulnerable function is reachable from your code.
- For Snyk Code, where the flagged data comes from and what validation it passes on the way.
What decides the verdict
Konvu returns exploitable, false positive, or inconclusive, with the reasoning behind it: the code it read, the conditions it tested, and what settled the call. When the answer depends on something only your team knows, Konvu asks a question instead of guessing.
Illustrative example
A lodash finding from Snyk Open Source
A made-up service, written to show how an investigation reads. Not a customer result.
- 1
Scanner finding
Snyk Open Source reports CVE-2021-23337, a command injection in lodash before 4.17.21, in the package-lock.json of a Node.js service that depends on lodash 4.17.20.
- 2
Application context
The service uses lodash for object and array helpers. The vulnerability needs the application to call _.template with a template or options an attacker can influence.
- 3
Investigation
Konvu confirms lodash 4.17.20 is installed and shipped with the service. It then searches the service for calls to _.template and imports of lodash/template, and finds none.
- 4
Verdict
False positive. The vulnerable function is never called, so the injection cannot be reached.
- 5
Evidence
The installed version, the lodash functions the service does call, and the search showing no path to _.template.
- 6
Where it ends up
An engineer reviews the evidence and dismisses the finding in Konvu. Konvu adds a Snyk ignore with the reason "not vulnerable" and a comment linking to the evidence. The lodash upgrade can wait for the normal dependency update cycle.
Writeback and controls
What changes in Snyk
- Dismissing an SCA finding in Konvu adds an ignore to the Snyk issue: type "not vulnerable", all paths, no expiry, with a comment naming who dismissed it and linking to the evidence in Konvu.
- Reopening the finding in Konvu removes the ignore.
Who triggers it
A person. Konvu adds an ignore only when someone on your team dismisses the finding in Konvu, one at a time or in bulk. It does not ignore Snyk issues on its own.
What stays with your team
- Snyk Code and container findings. Konvu records the verdict and evidence, and any change in Snyk is made there.
- Severity and priority scores in Snyk, which Konvu does not change.
Customer results with Snyk
Fintech SaaS
One fintech SaaS company running Konvu on its Snyk SCA and SAST findings. Figures as reported in the case study.
- 81%
- of Snyk findings flagged as false positives
- 50+
- hours of manual Snyk triage saved per week
- 3x
- faster remediation of critical vulnerabilities
Evaluation questions
More integrations
View all
Arnica
Add exploitability verdicts with evidence to Arnica SCA and SAST findings, and send approved SCA dismissals back to Arnica.
- SCA
- SAST
- ASPM
Black Duck
Get an exploitability verdict with evidence for Black Duck Polaris SCA findings and Coverity SAST findings.
- SCA
- SAST
Checkmarx
Send Checkmarx One SCA and SAST results to Konvu for an exploitability verdict with evidence, through the Konvu API or a report upload.
- SAST
- SCA
GitHub
Prioritize GitHub CodeQL and Dependabot alerts by adding exploit context to each finding.
- SAST
- SCA
- Ticketing & Messaging
GitLab
Add exploitability analysis to GitLab's built-in SAST and SCA pipeline findings.
- SCA
- SAST
- Ticketing & Messaging
Grype
Send Grype directory and SBOM scan results to Konvu through the API or CLI for an exploitability verdict on each vulnerable package.
- SCA
- Container Security