Snyk
Ranked 9 of 10 vulnerability scanners by recommenders
Scans repositories and containers for known vulnerabilities and exploits. Critics say it is slow to add new advisories and produces many false positives and misses.
Scans repositories and containers for known vulnerabilities and exploits. Critics say it is slow to add new advisories and produces many false positives and misses.
19 people gave an opinion
- recommend it
- 6
- criticize it
- 13
- approval share
- 32%
Recommended in 5 of 13 months
- November 2025: not recommended
- December 2025: recommended
- January 2026: not recommended
- February 2026: not recommended
- March 2026: not recommended
- April 2026: recommended
- May 2026: recommended
- June 2026: not recommended
- July 2026: recommended
- August 2026: recommended
- September 2026: not recommended
- October 2026: not recommended
- November 2026: not recommended (month in progress)
Why it doesn’t carry the badge
- 6 people recommend itNeeds 10 or more, not met.
- 0.4 recommenders for every criticNeeds 2 to 1 or better, not met.
- Recommended in 5 of 13 monthsNeeds 4 or more, met.
The same three rules apply to every product, and the badge can’t be bought. How the badge works
What people say about it
The reasons people give, with the number of comments that give each one. Open a reason to read what they said.
Why people recommend it
Each mark is one comment
Solves everyday security scanning needs
“Certainly not an amazing idea, but it solves the problem of the day.”
Comment from 3 Aug 2026 in “Critical CVE issued for hallucinated SQLite vulnerability” “scan containers and repositories for known exploits”
Comment from 17 Dec 2025 in “I got hacked: My Hetzner server started mining Monero” Respected security company
“if you're relying on them for security scanning, you should be able to trust them”
Comment from 15 Apr 2026 in “Tell HN: GitHub might have been leaking your webhook secrets. Check your emails.” “I do appreciate these security companies a lot”
Comment from 21 Jul 2026 in “NPM's release cooldown is security theater”
What people warn about
Each mark is one comment
Slow to flag new vulnerabilities
“So it seems that Snyk is taking almost a week to get advisories out for an RCE”
Comment from 18 May 2026 in “New Nginx Exploit” “passed them clean because there was nothing in the database yet”
Comment from 7 Mar 2026 in “NPM audit passes malicious packages with no CVE” “It seems that Snyk isn't picking this up on our docker images.”
Comment from 15 May 2026 in “New Nginx Exploit” - Comment from 24 Feb 2026 in “NPM install is stealing your passwords – I built a tool to catch it”
Many false positives and misses
“existing tools like Snyk give so many false positives and miss so many actual vulnerabilities”
Comment from 21 Sep 2026 in “Nobody pays for FOSS, we can force them to” “We use snyk at work and I have not been satisfied.”
Comment from 28 Jul 2026 in “OpenAI just open-sourced Codex Security” “pattern-match syntax, not behaviour”
Comment from 13 Feb 2026 in “Vulnerability scanner targeting logic bugs” Urgent upgrade alerts disrupt work
“Snyk routinely tells us that we need to upgrade urgently because they found a vulnerability in the Windows version of a package.”
Comment from 3 Aug 2026 in “Critical CVE issued for hallucinated SQLite vulnerability” “brought development to a standstill”
Comment from 2 Jun 2026 in “Anthropic scales Claude Mythos to critical infrastructure in 15 countries” Expensive for indie developers
“GitGuardian and Snyk charge $25-50/month which is expensive for indie developers.”
Comment from 5 Feb 2026 in “CodeShield AI – Open-source security scanner (24% cheaper than GitGuardian)” “Snyk and socket.dev take money for the pain and suffering”
Comment from 15 Apr 2026 in “Dependency cooldowns turn you into a free-rider”
Other vulnerability scanners people recommend
The four most recommended other vulnerability scanners, with the same counts for each, so you can compare like for like. The tick on each bar marks the 2 to 1 line the badge needs.
| Product | Recommend | Criticize | Approval | Months | Owned | Badge |
|---|---|---|---|---|---|---|
| OpenAI Codex Security | 21 | 30 | 41% | 4 | — | — |
| govulncheck | 13 | 0 | 100% | 9 | — | Approved |
| AISLE | 11 | 2 | 85% | 5 | — | Approved |
| Trivy | 10 | 23 | 30% | 5 | — | — |
| SnykThis page | 6 | 13 | 32% | 5 | — | — |
What people said
20 of the 21 comments that mention it, newest first. Each links to the original comment.
“only until hell freezes over”
“existing tools like Snyk give so many false positives and miss so many actual vulnerabilities”
“Certainly not an amazing idea, but it solves the problem of the day.”
“Snyk routinely tells us that we need to upgrade urgently because they found a vulnerability in the Windows version of a package.”
“tools like Veracode or Snyk to automatically assess for CVEs and block merges or deployments”
“I think it's quite telling of their quality.”
“How can I trust that they show me all findings they have instead of selling the best ones”
“We use snyk at work and I have not been satisfied.”
“I do appreciate these security companies a lot”
“brought development to a standstill”
“So it seems that Snyk is taking almost a week to get advisories out for an RCE”
“It seems that Snyk isn't picking this up on our docker images.”
“Snyk flagged a real transitive vulnerability in our production repo”
“if you're relying on them for security scanning, you should be able to trust them”
“Snyk and socket.dev take money for the pain and suffering”
“passed them clean because there was nothing in the database yet”
“If there's no CVE filed yet, they're blind.”
“pattern-match syntax, not behaviour”
“GitGuardian and Snyk charge $25-50/month which is expensive for indie developers.”
“scan containers and repositories for known exploits”
Counts come from 1,795,640 Hacker News comments, November 2025 to November 2026. How we count. Report a mistake.