> For the complete documentation index, see [llms.txt](https://developer.harness.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://developer.harness.io/security-testing-orchestration/3.0/use-sto/sto-scanner-configuration/snyk/snyk-scanner-reference.md).

# Snyk step configuration

The Snyk step in Harness STO enables you to perform Snyk [Code](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-code-scanning.md), [Open Source](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-open-source.md), [Container](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-open-source.md), and [IaC](/security-testing-orchestration/use-sto/sto-scanner-configuration/snyk/snyk-iac-scanning.md) scanning in both Orchestration and Ingestion modes of STO. This document will guide you through understanding the fields, configuring them, and providing any necessary information for setting up the step.

{% hint style="info" %}

* You can utilize custom STO scan images and pipelines to run scans as a non-root user. For more details, refer [Configure your pipeline to use STO images from private registry](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/set-up-sto-pipelines/configure-pipeline-to-use-sto-images-from-private-registry.md).
* STO supports three different approaches for loading self-signed certificates. For more information, refer [Run STO scans with custom SSL certificates](/security-testing-orchestration/3.0/troubleshooting-and-resources/sto-use-cases/secure-sto-pipelines/ssl-setup-in-sto.md#supported-workflows-for-adding-custom-ssl-certificates).
  {% endhint %}

### Snyk step settings <a href="#snyk-step-settings" id="snyk-step-settings"></a>

It is recommended to add a Snyk step to the **Security** or **Build** stage and configure it as described below.

#### Scan <a href="#scan" id="scan"></a>

**Scan Mode**

**Scan Configuration**

#### Target <a href="#target" id="target"></a>

**Type**

**Target and variant detection**

**Name**

**Variant**

**Workspace (*****repository*****)**

#### Container image <a href="#container-image" id="container-image"></a>

**Type**

**Domain**

**Name**

**Tag/Digest**

#### Authentication <a href="#authentication" id="authentication"></a>

**Access Token (*****Orchestration scans*****)**

#### Scan Tool <a href="#scan-tool" id="scan-tool"></a>

**Use Raw Scanner Severity**

#### Ingestion File <a href="#ingestion-file" id="ingestion-file"></a>

#### Log Level <a href="#log-level" id="log-level"></a>

#### Additional CLI flags <a href="#additional-cli-flags" id="additional-cli-flags"></a>

Use this field to run the [Snyk scanner](https://docs.snyk.io/snyk-cli/cli-commands-and-options-summary) with additional flags such as:

`--all-projects --detection-depth=3`

With these flags, the Snyk step scans recursively down the repository tree to a depth of 3 folders.

{% hint style="warning" %}

* Passing CLI flags is an advanced feature. Some flags might not work in the context of STO. You should test your flags and arguments thoroughly before you use them in your production environment.
* STO does not support [context-specific arguments](https://docs.snyk.io/snyk-cli/cli-commands-and-options-summary#less-than-context-specific_options-greater-than) or arguments that appear at the end of the command line, such as Maven or Gradle arguments.
  {% endhint %}

#### Fail on Severity <a href="#fail-on-severity" id="fail-on-severity"></a>

#### Settings <a href="#settings" id="settings"></a>

#### Additional Configuration <a href="#additional-configuration" id="additional-configuration"></a>

#### Advanced settings <a href="#advanced-settings" id="advanced-settings"></a>

### Show original issue severities overridden by Snyk security policies <a href="#show-original-issue-severities-overridden-by-snyk-security-policies" id="show-original-issue-severities-overridden-by-snyk-security-policies"></a>

Harness originally will categorize a scan utilizing the CVSS scores that are provided, and using it to categorize vulnerabilities into **Critical, High, Medium, and Low** categories

With the Snyk Step, or a [Custom Scan Step](/security-testing-orchestration/use-sto/sto-custom-scanning-and-ingestion/custom-scan-reference.md) utilizing a self installed Snyk runner, you can configure Harness to utilize the severity scores in a [Snyk Enterprise security policy](https://docs.snyk.io/enterprise-configuration/policies/security-policies), and provide an override severity for an issue. This can be adjusted from your Snyk results, or it can also come from the `snyk` CLI. You can see this information in **Issue Details**.

Harness will also display the information that the severity was overridden, and the original score, so long as the report follows the Snyk required format

This feature is supported for `snyk container` and `snyk test` JSON output that properly reflects an override.

#### Requirement <a href="#requirement" id="requirement"></a>

* [STO Plugin version 1.56.x or higher](https://hub.docker.com/r/harness/sto-plugin/tags)

#### JSON Output Format <a href="#json-output-format" id="json-output-format"></a>

Please note that the override format must follow the Snyk documented process, such as [in the following Snyk example.](https://docs.snyk.io/supported-languages-package-managers-and-frameworks/c-c++/snyk-cli-for-open-source-c++-scans)

The formatting should contain the following:

* A value, `originalSeverity`, needs to be defined, and should contain the original severity value
* The `severity` value can now be defined with the new severity value. Below is a portion of an adjusted vulnerability sample:

```
{  
     "vulnerabilities": [
        {
            "id": "SNYK-JS-POSTCSS-5926692",
            "title": "Improper Input Validation",
            "CVSSv3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
            "credit": [
                "Unknown"
            ],
            "semver": {
                "vulnerable": [
                    "<8.4.31"
                ]
            },
            "exploit": "Not Defined",
            "fixedIn": [
                "8.4.31"
            ],
            "patches": [],
            "insights": {
                "triageAdvice": null
            },
            "language": "js",
            "severity": "critical",
            "originalSeverity": "medium",
            "cvssScore": 5.3,
            "functions": [],
            "malicious": false,
            "isDisputed": false,
            "moduleName": "postcss",
            [...]
        }
    ]
 }
```

### Proxy settings <a href="#proxy-settings" id="proxy-settings"></a>