Start to use Snyk

[RomaricMourgues]

• [x] @RomaricMourgues
• [ ] @oubchid
• [x] @rezk2ll

You have received an invitation to Snyk by email. It is for later sync between vscode and snyk

On VSCode search in the extension marketplace "Snyk" and install "Snyk Security - Code and Open Source Dependencies". Then you'll have a little icon on left bottom, click on "Connect VS Code with Snyk".

Then also enable code security. If it says it is not enable dfor org, go to https://app.snyk.io/org/{your snyk username}/manage/snyk-code?from=vscode and enable it.

-- From Fredy:

Dear developers this is the Snyk information specially selected for you:

• Intro: "Snyk is a developer security platform for securing code, dependencies, containers, and infrastructure as code"
• Visual: Take a look to the iceberg tip attached image
• Snyk Open Source: "Avoid vulnerable dependencies"
• Snyk Code: "Secure your code as it's writen"
• Linagora devs: "Using Snyk for IDE or CLI helps you to avoid frustrations at PR/MR where Snyk will scan your code"
• Policy for devs: Create your own Snyk account and use it for yourself BUT do not create or modify the policy (.snyk file in repos)
• Snyk for IDEs documentation: https://docs.snyk.io/products/snyk-code/using-snyk-code-via-ide
• Snyk CLI cheat-sheet: https://snyk.io/blog/snyk-cli-cheat-sheet/ -> Snyk Open Source: snyk test -> Snyk Code: snyk code test

This supposed to be enough but as always people wants to know why:

• One of the few modern security tools adapted for the devops way
• Trusted by big companies like Google that take security seriously.
• Snyk can cover from writing the code until watching a k8s cluster in production
• Frequently deliver new features like support for more languages.
• Technical support fast and good (for free)
• Snyk does not require infrastructure administration is a free service (not all services) for OpenSource projects.
• One tool for all kind of projects, from scanning private repositories using the command line to full integration with GitHub and GitLab PR/MR that provide a central point where we can check the status for all our software projects. We can also use it for private setups like we did for the EU Parliament.
• 2022 Container Security Trends: https://go.snyk.io/rs/677-THP-415/images/Snyk2PulseMeter%20%281%29.pdf

And yes, we know that Snyk is not OpenSource and we do not qualify for their OpenSource program (to get extra features) because is for communities not for companies.

[RomaricMourgues]

@digitalfredy here's the issue for our first tester of this new Snyk feature

[digitalfredy]

As this is a public issue, I want to clarify we already use Snyk but this is about the adoption by developers in order to help them to avoid security issues while writing code ;)

[digitalfredy]

This is the attached image from my email:

[RomaricMourgues]

@rezk2ll could you read this quickly and start using Snyk on you VSCode ? :)