How do you integrate Snyk into CI/CD to block vulnerabilities without slowing development?
⚡
Quick Answer
Use snyk test --severity-threshold=high in CI. Run snyk monitor in production. Use .snyk policy files for accepted risks.
Detailed Answer
Integration: 1) CI: snyk test --severity-threshold=high --fail-on=upgradable. 2) CD: snyk container test myimage:tag. 3) Production: snyk monitor for continuous scanning. 4) .snyk policy for accepted risks with expiry. 5) PR checks before merge. Principle: fail on fixable critical, notify on rest, document accepted.
Code Example
snyk test --severity-threshold=high --fail-on=upgradable snyk container test myapp:latest --severity-threshold=critical snyk monitor --project-name=payments-api
💡
Interview Tip
Show the tiered approach: block critical in CI, scan containers in CD, monitor in production.
snykci-cdvulnerability-scanningsca