Snyk used in GitHub projects

[sourabhsparkala]

The GitHub project uses Snyk for code analysis and sometimes creates PR with the suggestion

Things to do:

• Check if information can be extracted from GitHub PRs, if Snyk is used in the project.
• Check if Snyk configuration exists within the project.

For more information can be found in https://snyk.io/blog/getting-started-snyk-for-secure-python-development/

[ManjunathMS35]

Snyk can be a SAST tool and a dependency checker:

The information if a GitHub project uses Snyk can be found by checking the,

1. Existence of policy file (.snyk), which can be in root directory or any folder
2. Commits done by snyk-bot
3. Snyk Action config in .github folder
4. CI yaml config file containing Snyk CLI scans config

Sample Golang open source repos: https://github.com/gofiber/fiber , https://github.com/openfga/openfga , https://github.com/Unity-Technologies/go-svrquery