> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/snyk/snyk-open-source.md).

# Snyk Open Source scanning

The Snyk step in Harness STO identifies and fixes vulnerabilities in your project's dependencies, including both direct and transitive ones. This document will guide you through configuring the Snyk step in your pipeline for [Snyk Open Source](https://docs.snyk.io/scan-using-snyk/snyk-open-source) scanning, using either the orchestration or ingestion scan modes in STO.

* [**Orchestration mode**](#snyk-open-source-scan---orchestration-mode): In this mode, the Snyk step [runs the scan](/security-testing-orchestration/3.0/new-to-sto/key-concepts/run-an-orchestrated-scan-in-sto.md), then normalizes and deduplicates the results.
* [**Ingestion mode**](#snyk-open-source-scan---ingestion-mode): In this mode, the Snyk step [reads scan results](/security-testing-orchestration/3.0/new-to-sto/key-concepts/ingest-scan-results-into-an-sto-pipeline.md) from a data file, normalizes the data, and deduplicates it.

### Build requirements for Snyk Open Source scanning <a href="#build-requirements-for-snyk-open-source-scanning" id="build-requirements-for-snyk-open-source-scanning"></a>

To perform a Snyk Open Source scan, you need to execute the command `snyk test` on your project. In the case of Orchestration, the Snyk step does this automatically for you. For Ingestion, you’ll need to run this command through a Run step. The `snyk test` command attempts to autodetect your project type by searching for a manifest file. Depending on your project, this file might be `package-lock.json`, `yarn.lock`, `pom.xml`, or another type. For more details on the files Snyk uses to detect your project type, refer to the [Snyk documentation](https://docs.snyk.io/snyk-cli/scan-and-maintain-projects-using-the-cli/snyk-cli-for-open-source#files-snyk-uses-to-detect-the-project-type).

Depending on your project type and requirements, you may need to build your project before the pipeline executes the Snyk Open Source scan. You can use a Run step to build your project.

Refer to the table below to determine whether your project requires a build for successful scanning. For Orchestration mode, If a build is necessary, continue from the section [Build your project using the Run step](#build-your-project-using-run-step). If not, you can skip that section and proceed directly to [Configure the Snyk step for Open Source scanning](#configure-snyk-step-for-open-source-scanning).

<details open>

<summary>Build requirements for Snyk Open Source scanning</summary>

| Language          | Project Type | Build Required | Notes                                                                                                                                                                           |
| ----------------- | ------------ | -------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| JavaScript        | npm          | No\*           | Build only required if no `package-lock.json` file present; run `npm install` to generate.                                                                                      |
| JavaScript        | Yarn         | No\*           | Build only required if no `yarn.lock` file present; run `yarn install` to generate.                                                                                             |
| Java              | Maven        | Yes            | Run `mvn install` before testing.                                                                                                                                               |
| Java              | Gradle       | No             | [Orchestration mode](#snyk-open-source-scan---orchestration-mode) is not supported at the moment. Please use [Ingestion mode](#snyk-open-source-scan---ingestion-mode) instead. |
| .NET              | NuGet        | No\*           | Build required only if no `packages.config` file is present                                                                                                                     |
| .NET              | Paket        | Yes            | [Orchestration mode](#snyk-open-source-scan---orchestration-mode) is not supported at the moment. Please use [Ingestion mode](#snyk-open-source-scan---ingestion-mode) instead. |
| Python            | Pip          | Yes            | [Orchestration mode](#snyk-open-source-scan---orchestration-mode) is not supported at the moment. Please use [Ingestion mode](#snyk-open-source-scan---ingestion-mode) instead. |
| Python            | Setup.py     | Yes            | [Orchestration mode](#snyk-open-source-scan---orchestration-mode) is not supported at the moment. Please use [Ingestion mode](#snyk-open-source-scan---ingestion-mode) instead. |
| Python            | Poetry       | No\*           | Build only required if no `poetry.lock` file present; run `poetry lock` to generate.                                                                                            |
| Ruby              | Bundler      | No\*           | Build only required if no `Gemfile.lock` file present; run `bundle install` to generate.                                                                                        |
| PHP               | Composer     | No\*           | Build only required if no `composer.lock` file present; run `composer install` to generate.                                                                                     |
| Scala             | SBT          | No             | [Orchestration mode](#snyk-open-source-scan---orchestration-mode) is not supported at the moment. Please use [Ingestion mode](#snyk-open-source-scan---ingestion-mode) instead. |
| Go                | Go Modules   | No             | [Orchestration mode](#snyk-open-source-scan---orchestration-mode) is not supported at the moment. Please use [Ingestion mode](#snyk-open-source-scan---ingestion-mode) instead. |
| Swift/Objective-C | CocoaPods    | No\*           | Build only required if no `Podfile.lock` file present; run `pod install` to generate.                                                                                           |

**Notes:**

* \* indicates languages where Snyk can typically infer dependencies without building the project, but a build might be necessary depending on specific project configurations.
* Refer to the official Snyk documentation for more details on language-specific [requirements and troubleshooting](https://docs.snyk.io/snyk-cli/scan-and-maintain-projects-using-the-cli/snyk-cli-for-open-source/open-source-projects-that-must-be-built-before-testing-with-the-snyk-cli).

</details>

### Snyk Open Source scan - Orchestration mode <a href="#snyk-open-source-scan-orchestration-mode" id="snyk-open-source-scan-orchestration-mode"></a>

The Snyk Open Source scan may require your project to be built beforehand. Check the [Build requirements for Snyk Open Source scan](#build-requirements-for-snyk-open-source-scanning) to see if a build is necessary. If your project doesn’t need a build, you can skip the [Build your project using the Run step](#build-your-project-using-run-step) section.

{% hint style="info" %}
Snyk Open Source scans can be memory-intensive for medium to large repositories or repositories with many dependencies. If insufficient memory is allocated, the scan process may be terminated unexpectedly (with, exit code `2` due to `signal: killed`).

**Recommended memory:** Start with **1.5 GB** allocated to the step in the Additional Configuration, and adjust as needed based on repository size and number of dependencies.
{% endhint %}

#### Build your project using Run step <a href="#build-your-project-using-run-step" id="build-your-project-using-run-step"></a>

Depending on your project type, you can use a Run step to build your project. Refer to the [table](#build-requirements-for-snyk-open-source-scanning) for more details. Ensure this is configured before the Snyk step in your pipeline.

1. Add the **Run** step to your pipeline.
2. Set the **Shell** field to `sh`.
3. In the **Command** field, enter the command to build your project. This will vary based on your project type. For example, use `npm install` or `yarn install` for JavaScript projects.
4. Under **Optional Configuration**, configure your container registry and the image that facilitates your project build.
   1. Set the **Container Registry** using Harness connectors.
   2. Enter the **Image** name needed for the build process.
5. Apply the changes and save the pipeline.
6. You can now configure the **Snyk** step to perform the Snyk Open Source scan.

#### Configure Snyk step for Open Source scanning <a href="#configure-snyk-step-for-open-source-scanning" id="configure-snyk-step-for-open-source-scanning"></a>

To perform Snyk Open Source scanning with orchestration scan mode, follow the below steps:

1. Search and add the **Snyk** step to your pipeline. You can use this step in **Build** stage or **Security** stage.
2. In the step configuration, set the following fields
   1. Set the [**Scan Mode**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md#scan-mode) to **Orchestration**
   2. Under [**Target**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md#target), set the **Type** to **Repository**
   3. Set the [**Scan Configuration**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md#scan-configuration) to **Snyk Open-Source**
   4. For [**Target and Variant Detection**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md#target-and-variant-detection) it's preferred to use **Auto** option or you can define them using the **Manual** option.
   5. Under [**Authentication**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md#authentication), pass your Snyk API as Harness secret, for example: `<+secrets.getValue("snyk_api_token")>`

Refer to [Snyk step configuration](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md) document to learn more about all the fields and their configurations.

### Snyk Open Source scan - Ingestion mode <a href="#snyk-open-source-scan-ingestion-mode" id="snyk-open-source-scan-ingestion-mode"></a>

In the Ingestion scan mode, the Snyk step reads data from a file, normalizes it, and deduplicates it. To perform a Snyk Open Source scan using the Ingestion scan mode, we will use two steps:

1. **Run step**: Scan the repository with Snyk CLI and save the output to a shared folder. You can also install the dependencies if required.
2. **Snyk step**: To ingest the scan results from the output.

#### Requirements <a href="#requirements" id="requirements"></a>

1. Configure your code repository in your stage, you can do it in the **Build** stage or **Security** stage
2. Go to the **Overview** tab of the stage. Under **Shared Paths**, enter the following path: `/shared/scan_results`, this will be the location where the Run step will save the scan results.

#### Configure Run step <a href="#configure-run-step" id="configure-run-step"></a>

1. Add the **Run** step to the pipeline and open the step configuration.
2. In the **Container Registry** section, set your DockerHub connector. Snyk images will be pulled from their DockerHub account.
3. For **Image**, use a supported [Snyk image](https://hub.docker.com/r/snyk/snyk) based on your project type and language. For example, use `snyk/snyk:node` for a Node.js project.
4. Set the **Shell** field to `sh`
5. In the **Command** field, enter the following command.

   ````
    ```
    # Build the project
    npm install

    # Snyk Open Source scan

    snyk  --file=SubSolution.sln  test \   --sarif-file-output=/shared/scan_results/snyk_scan_results.sarif || true
    snyk monitor --all-projects | true
    ```
   ````

   Note: The command to build your project depends on its type. Refer to the [table](#build-requirements-for-snyk-open-source-scanning) to determine if your project requires a build.
6. In **Optional Configuration**, under **Environment Variables**, add a variable to access your Snyk API key:\
   SNYK\_TOKEN = `<+secrets.getValue("snyk_api_token")>`
7. In **Advanced** tab under **Failure Strategies**, set the Failure Strategy to **Mark as Success**. This step is required to ensure that the pipeline proceeds if Snyk finds a vulnerability. Otherwise, the build exits with an error code before STO can ingest the data.

#### Configure Snyk step <a href="#configure-snyk-step" id="configure-snyk-step"></a>

1. Add the **Snyk** step and open the step configuration.
2. Set the [**Scan Mode**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md#scan-mode) to **Ingestion**.
3. Set the [**Target Type**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md#target) to **Repository**.
4. For [**Target and Variant Detection**](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md#target-and-variant-detection), define them with the **Manual** option selected.
5. In the **Ingestion File** field, enter `/shared/scan_results/snyk_scan_results.sarif`.
6. Apply your changes, save the configuration, and run the pipeline.

Refer to [Snyk step configuration](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md) document to learn more about all the fields and their configurations.