Snyk Code

Connect Snyk Code — Snyk’s static application security testing (SAST) product — to bring its findings into BestDefense and route them through the Remediation Queue, where Vortex AI generates a fix pull request for each finding. It’s the Snyk-shaped sibling of the SonarQube integration: the same connect → map → sync → remediate loop.

Snyk Code tells you where the vulnerabilities are. This integration closes the loop: verified findings become Remediation Queue cards, and one action (or an auto-advance guardrail policy) dispatches an AI remediation that opens a pull request against the mapped repository.

Note

The Snyk integration requires a Vortex Growth tier or higher, and a connected version-control repository — remediation opens pull requests, so it needs somewhere to put them.

What you get

• Automatic sync of open Snyk Code issues into BestDefense, refreshed on a schedule or on demand with Sync now.
• Group deduplication. Identical findings (same rule and message in one repository) collapse into a single Remediation Queue card and a single fix pull request — N copies of the same mistake don’t become N cards or N credits.
• Automated remediation through the existing Vortex pipeline: one AI fix → one pull request addressing every affected file in the group → one remediation credit.
• One board for everything. Snyk findings share the Remediation Queue with Vortex pen-test findings and SonarQube issues. The columns, guardrails, approve/merge/reject actions, and CI status all work identically. There’s no separate Snyk issues page — the queue is where Snyk findings live.

Prerequisites

Before you connect Snyk:

1. A Vortex Growth subscription (or higher).
2. A connected version-control repository — connect GitHub first. Only GitHub-mapped projects are eligible for automated remediation in v1.
3. Your Snyk details:
   • Organization ID — the UUID in Snyk under Settings → General → Organization ID.
   • API token — generate one under Account settings → API token.
   • API URL — https://api.snyk.io, or your regional endpoint (for example https://api.eu.snyk.io).

Only a user with the Manage Integrations permission can connect or manage the integration — see Members & roles.

Step 1 — Connect Snyk

1. Go to Integrations and open the Snyk card.
2. Choose Connect.
3. In the modal, enter your Snyk API URL (defaults to https://api.snyk.io), your Organization ID, and your API token.
4. Choose Test connection to verify the credentials, then Connect.

The token is validated against Snyk before anything is saved. On success it’s encrypted with your organization’s AWS KMS key and stored as ciphertext — the plaintext token is never persisted, returned to your browser, or logged. Only one Snyk integration is allowed per organization.

Step 2 — Map projects to repositories

Snyk findings are only actionable once a Snyk project is paired with a repository.

1. On the connected Snyk card, choose Mappings.
2. In the drawer, pick a Repository (your GitHub-visible repos), a Snyk project, and a branch (defaults to main).
3. Choose Add mapping.

• A Snyk project and a repository can each be mapped once.
• Only GitHub repositories are eligible for automated remediation in v1.
• Remove a mapping with the trash icon on its row.

Step 3 — Sync findings

Choose Sync now on the Snyk card to queue an immediate sync, or wait for the scheduled sync (daily by default). The sync fetches open Snyk Code issues for each mapped project, caches them, drops issues Snyk no longer reports, and refreshes the Remediation Queue.

Step 4 — Remediate from the queue

1. Go to Remediation → Queue.
2. Snyk findings appear as Findings-column cards with a Snyk source badge. Each card is one group of identical findings.
3. Trigger remediation on a card (or let an auto-advance policy do it). Vortex AI produces a pull request against the mapped repository addressing every file in the group; the card advances Remediate → Review, and guardrails/CI/merge-watch apply exactly as they do for other sources.
4. Review, approve, and merge the pull request as usual.

Disconnecting

On the connected Snyk card, choose Disconnect. This removes the integration and its repository mappings, and cached issues for those mappings are dropped on the next sync. In-flight and completed remediation cards and pull requests are kept as history.

Scope and limits (v1)

• Snyk Code only. Snyk Open Source (SCA), Container, and IaC are not synced.
• GitHub-only remediation. Only Snyk projects mapped to a GitHub repository can receive automated pull requests.

Troubleshooting

Symptom	Fix
”Requires Vortex Growth” on the card	Upgrade the subscription — see Billing & tiers.
Connect blocked with a VCS message	Connect a GitHub repository first.
Repository dropdown empty in the mappings drawer	GitHub isn’t connected, or the token can’t see any repositories.
A finding never becomes a card	Confirm the project is mapped to a GitHub repo (GitLab-mapped projects aren’t remediable in v1) and that a sync has run.

Next steps

• Work the findings: Remediation Queue.
• File findings into your tracker: Jira.