Snyk Code

The Snyk Code integration allows Guard to ingest static analysis findings from your Snyk organisation, surfacing them as vulnerabilities in the platform. Teams already using Snyk for code scanning can consolidate those results alongside Guard's attack-surface and exploitation data without changing their existing scanning workflows.

How it works

Snyk Code findings are pulled using the same ingestion pipeline as other vulnerability integrations. Once imported, findings appear in the vulnerability table and are subject to the same triage, risk-scoring, and ticketing capabilities available to all Guard vulnerabilities.

Prerequisites

Before connecting, ensure you have:

• A Snyk account with Snyk Code enabled.
• A Snyk API token with read access to the target organisation.
• Your Snyk organisation ID.

Connect Snyk Code to Guard

1. In Guard, navigate to Integrations > Secure Code Scanning > Snyk Code.
2. Enter your Snyk API token.
3. Enter your Snyk organisation ID.
4. Save the configuration.

Guard will begin importing findings from your Snyk organisation. New findings discovered by Snyk in subsequent scans are picked up automatically on the next sync.

Imported data

Working with imported findings

Imported Snyk Code vulnerabilities support the full Guard remediation workflow:

• Triage — set status, assign owners, and add notes.
• Ticketing — create or link tickets via configured ticketing integrations (e.g., Jira).
• Risk scoring — findings are scored consistently with other vulnerability sources, enabling unified prioritisation.

Troubleshooting

No findings appear after connecting

• Confirm the API token has read access to the specified organisation.
• Verify that Snyk Code scans have run and produced results in your Snyk organisation before the sync.

Authentication errors

• Regenerate your Snyk API token and update the credential in Integrations > Secure Code Scanning > Snyk Code.
• Ensure the organisation ID matches the Snyk organisation associated with the token.