Skip to main content

​
Overview

Snyk is a developer security platform covering open source dependencies (SCA), container images, infrastructure as code, and code (SAST). The Pwnbook Snyk integration imports findings from your Snyk organization so you can review and track them alongside other security findings.

​
Prerequisites

  • A Snyk account (Free, Team, or Enterprise)
  • A Snyk API token
  • Your Snyk organization ID
  • Admin or Owner access in Pwnbook to configure the integration

​
Credentials required

​
Setup

1

Generate a Snyk API token

  1. Log in to snyk.io.
  2. Click your account name → Account Settings.
  3. Under General, copy your Auth Token.
For team or enterprise environments, create a service account token instead:
  1. Go to Organization Settings → Service Accounts.
  2. Click Create a service account.
  3. Give it a name (e.g., pwnbook) and assign the Viewer role.
  4. Copy the generated token.
Service account tokens are preferred for integrations because they aren’t tied to a personal account and have finer-grained permissions.
2

Find your organization ID

  1. In Snyk, go to Organization Settings → General.
  2. Copy the Organization ID (UUID format).
If you have multiple Snyk orgs, repeat the integration setup for each one.
3

Configure the integration in Pwnbook

  1. Go to Organization Settings → Marketplace → Snyk.
  2. Click Configure.
  3. Enter your API Token and Organization ID.
  4. Click Save & Test.

​
What gets synced

​
Viewing findings in Pwnbook

Synced Snyk findings appear under Security Findings → Snyk in your organization. You can:
  • Filter by severity, issue type, and project
  • View CVSS scores, CVE details, and fix recommendations
  • Assign findings to tasks
  • Mark findings as resolved or suppressed

​
Disconnecting

To remove the Snyk integration:
  1. Go to Organization Settings → Marketplace → Snyk.
  2. Click Disconnect.
  3. Confirm.
Previously synced findings remain in Pwnbook until manually deleted.