235 lines
6.8 KiB
Markdown
235 lines
6.8 KiB
Markdown
# Security AI Tool Evaluation: Snyk
|
|
|
|
## Tool Overview
|
|
**Name:** Snyk
|
|
**Type:** Developer Security Platform
|
|
**Website:** https://snyk.io
|
|
**Primary Function:** Code security scanning, dependency vulnerability detection, container security, IaC security
|
|
|
|
---
|
|
|
|
## Privacy Policy & Enterprise Compatibility
|
|
|
|
### Commercial/Enterprise Use Permission
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Privacy Policy: https://snyk.io/privacy-policy/
|
|
- Terms of Service: https://snyk.io/policies/terms-of-service/
|
|
- Enterprise Documentation: https://docs.snyk.io/
|
|
|
|
**Key Questions:**
|
|
- Does the privacy policy explicitly permit commercial use?
|
|
- Are there any restrictions on enterprise deployment?
|
|
- What is the licensing model for commercial use?
|
|
|
|
### Data Training & Model Use
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Privacy Policy: https://snyk.io/privacy-policy/
|
|
- DeepCode AI Terms: https://snyk.io/product/snyk-code/ (Snyk uses AI for code analysis)
|
|
- Data Processing Agreement: Available through enterprise sales
|
|
|
|
**Key Questions:**
|
|
- Is customer code used to train or improve AI models?
|
|
- Can customers opt out of data collection for model training?
|
|
- How is code analyzed (locally vs cloud)?
|
|
- What data is collected during scans?
|
|
|
|
### Data Retention Policies
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Privacy Policy: https://snyk.io/privacy-policy/
|
|
- Data Processing Agreement (DPA)
|
|
- Security documentation: https://snyk.io/product/secure-development/
|
|
|
|
**Key Questions:**
|
|
- How long is scan data retained?
|
|
- How long are vulnerability reports stored?
|
|
- What is the data deletion policy?
|
|
- Can customers request data deletion?
|
|
|
|
### Data Sharing Policies
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Privacy Policy: https://snyk.io/privacy-policy/
|
|
- Subprocessor List: Check privacy policy or DPA
|
|
- Security whitepaper
|
|
|
|
**Key Questions:**
|
|
- Is data shared with third parties?
|
|
- Who are the subprocessors?
|
|
- Is data shared across Snyk customers?
|
|
- Are vulnerability patterns aggregated/anonymized?
|
|
|
|
### IP & Confidentiality Concerns
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Terms of Service: https://snyk.io/policies/terms-of-service/
|
|
- Enterprise Agreement
|
|
- Intellectual Property Policy
|
|
|
|
**Key Questions:**
|
|
- Who owns the IP rights to scan results?
|
|
- Are there confidentiality protections for proprietary code?
|
|
- What happens to customer code during scanning?
|
|
- Is code stored or only analyzed?
|
|
- Are there NDA provisions for enterprise customers?
|
|
|
|
---
|
|
|
|
## Pricing & Plans
|
|
|
|
### Free Tier
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Pricing Page: https://snyk.io/plans/
|
|
- Free Tier Documentation: https://docs.snyk.io/getting-started/snyk-plans
|
|
|
|
**Information Needed:**
|
|
- **Features Included:** List specific features (e.g., Snyk Open Source, Snyk Code, etc.)
|
|
- **Project Limits:** Number of projects that can be scanned
|
|
- **User Limits:** Number of team members
|
|
- **Scan Limits:** Number of scans per month
|
|
- **Test Limits:** Tests per month
|
|
- **Duration:** Is it free forever or a trial?
|
|
- **Support Level:** Community vs paid support
|
|
|
|
### Paid Plans
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Pricing Page: https://snyk.io/plans/
|
|
- Contact sales for enterprise pricing
|
|
|
|
**Plans to Document:**
|
|
|
|
#### Team Plan
|
|
- **Cost:** $ per user/month (check current pricing)
|
|
- **Features:** List key features
|
|
- **Limits:** Projects, users, scans, tests
|
|
- **Support:** Level of support included
|
|
|
|
#### Business Plan
|
|
- **Cost:** $ per user/month (check current pricing)
|
|
- **Features:** Advanced features beyond Team
|
|
- **Limits:** Higher limits or unlimited?
|
|
- **Support:** Priority support?
|
|
|
|
#### Enterprise Plan
|
|
- **Cost:** Custom pricing (contact sales)
|
|
- **Features:** Full feature set, SSO, advanced integrations
|
|
- **Limits:** Typically unlimited or very high
|
|
- **Support:** Dedicated support, SLAs
|
|
- **Additional:** Custom DPA, compliance certifications
|
|
|
|
---
|
|
|
|
## Usage Limits
|
|
|
|
### API Rate Limits
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- API Documentation: https://docs.snyk.io/snyk-api
|
|
- Rate Limiting Documentation
|
|
|
|
**Information Needed:**
|
|
- Requests per hour/day
|
|
- Concurrent scan limits
|
|
- CLI usage limits
|
|
- Different limits per plan tier
|
|
|
|
### Project Limits
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Information Needed:**
|
|
- Number of projects per organization
|
|
- Number of active projects
|
|
- Limits vary by plan tier
|
|
|
|
### User/Seat Limits
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Information Needed:**
|
|
- Minimum seats for paid plans
|
|
- Maximum collaborators
|
|
- Guest user policies
|
|
|
|
### Scan Limits
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Information Needed:**
|
|
- Number of scans per month
|
|
- Size limits for scanned repositories
|
|
- Timeout limits for scans
|
|
- Concurrent scan limits
|
|
|
|
---
|
|
|
|
## Enterprise-Specific Considerations
|
|
|
|
### Compliance & Certifications
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Sources to Check:**
|
|
- Security page: https://snyk.io/trust-and-security/
|
|
- Compliance documentation
|
|
|
|
**Check for:**
|
|
- SOC 2 certification
|
|
- ISO 27001
|
|
- GDPR compliance
|
|
- CCPA compliance
|
|
- Industry-specific compliance (HIPAA, etc.)
|
|
|
|
### Deployment Options
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Check for:**
|
|
- Cloud-hosted (SaaS)
|
|
- Self-hosted/on-premise options
|
|
- Private cloud deployment
|
|
- Air-gapped environment support
|
|
|
|
### Security Features
|
|
**Status:** REQUIRES MANUAL VERIFICATION
|
|
**Check for:**
|
|
- SSO/SAML support
|
|
- Role-based access control (RBAC)
|
|
- Audit logging
|
|
- Data encryption (in transit and at rest)
|
|
- Broker for on-premise scanning
|
|
|
|
---
|
|
|
|
## Research Checklist
|
|
|
|
- [ ] Read complete privacy policy
|
|
- [ ] Review terms of service
|
|
- [ ] Check pricing page for current costs
|
|
- [ ] Review API documentation for rate limits
|
|
- [ ] Check for Data Processing Agreement (DPA)
|
|
- [ ] Verify GDPR/compliance information
|
|
- [ ] Review documentation for deployment options
|
|
- [ ] Check for customer references/case studies
|
|
- [ ] Contact sales for enterprise-specific information
|
|
- [ ] Review security whitepaper if available
|
|
|
|
---
|
|
|
|
## Additional Resources
|
|
|
|
- Documentation: https://docs.snyk.io/
|
|
- Security: https://snyk.io/trust-and-security/
|
|
- Support: https://support.snyk.io/
|
|
- Blog: https://snyk.io/blog/
|
|
- GitHub: https://github.com/snyk
|
|
|
|
---
|
|
|
|
## Notes
|
|
|
|
**Important Considerations for Snyk:**
|
|
1. Snyk acquired DeepCode (AI-powered code analysis) - understand how AI is used
|
|
2. Check if Snyk Code (SAST) has different data handling than Snyk Open Source
|
|
3. Verify if Snyk Broker (for on-premise scanning) addresses data sovereignty concerns
|
|
4. Understand the difference between CLI, IDE, and CI/CD scanning for data handling
|
|
5. Check if vulnerability database updates require data sharing
|
|
|
|
**Last Updated:** [DATE TO BE ADDED AFTER RESEARCH]
|
|
**Researcher:** [TO BE COMPLETED]
|
|
**Verification Status:** Template - Requires Manual Research
|