netlify-plugin-snyk
A Netlify Build plugin to find security vulnerabilities
About
A Snyk Netlify build plugin to add to your Netlify website's pipeline and guard you from deploying static websites with known JavaScript vulnerabilities.
Usage
How to add security controls to your website build pipeline in 3 easy steps?
-
Add the plugin!
If you're using Netlify's UI, browse the Plugins directory and add
netlify-plugin-snyk
to your website project.Otherwise, if you use Netlify's configuration then add the plugin to your project's dependencies:
npm install netlify-plugin-snyk --save-dev
and then declare the plugin via a
netlify.toml
configuration file as follows:# netlify.toml [[plugins]] package = "netlify-plugin-snyk"
-
Configure the Snyk API token
If you alreay have the Snyk CLI installed you can get the token via
snyk config get api
and add an entry in Netlify's Environment variable settings page with variable nameSNYK_TOKEN
.Note: For CI integrations and alike, we recommend creating a Service account (available on the pro plan) at an org-level to avoid coupling the Snyk token to a personal user account.
To obtain a Snyk API token visit your Snyk account page.
-
Deploy safely
🐶
How it works?
- The Snyk security test runs on the
onPreBuild
event which means it gets triggered first, before a build has even started so it can fail fast and quick if any issues are found and you can attend to fixin them first. - The security scan will automatically detect the package manager used in the project and will only scan production dependencies to reduce signal-to-noise ratio.
Configuration
Plugin inputs
The plugin can be configured via a plugins.inputs
section on the netlify.toml
file. For example:
[[plugins]]
package = "netlify-plugin-snyk"
[plugins.inputs]
failOnPreviews = true
yarnWorkspaces = false
Available plugin configuration via inputs:
name | description | default |
---|---|---|
failOnPreviews |
Set this to false if you want to allow deploy previews to pass with a failed Snyk security scan. |
true and it means deploy previews will fail if Snyk detects security issues |
yarnWorkspaces |
If your repository uses Yarn Workspaces set this to true which adds the --yarn-workspaces flag |
false |
Future configuration options to be added:
- Set the Snyk organization to associate with the scan
- Set severity level thresholds on which to fail
- Set the Snyk API token via an input configuration (but recommend against setting it in code)
- Set the plugin to automatically monitor the project on the Snyk UI (configurable to 'never', 'all', 'deploys')
Contributing
Please consult CONTRIBUTING for guidelines on contributing to this project.