Snapshot 13981
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content
Snyk
Trust is paramount at Snyk. Our Developer Security Platform uses AI-driven insights to secure your entire software supply chain and AI-generated code. We ensure transparency: customer code is never used for AI training. We uphold ISO 27001, SOC2 Type II, and GDPR compliance, protecting your data with encryption and regional residency. Explore our commitment to innovative, trustworthy security.
trustassurance@snyk.io
Privacy PolicyOpens in new tab
Compliance
ISO 27001:2022
ISO 27017:2015
SOC 2 Type II
PCI DSS - SAQ A
Secure by Design Pledge
FedRAMP Rev. 5
Resources
View all
Compliance
Security and Compliance Overview
PCI-DSS Certificate
PCI-DSS SAQ
View 1 more
Penetration Tests
Pentest: Container
Pentest: Infrastructure as Code (IaC)
Pentest: Network
Pentest: 2025-10 - Snyk Open Source SCA
View 3 more
Architecture Diagram
Snyk Architectural Diagrams
Policies
Security Addendum
Opens in new tab
Data Processing Addendum
Opens in new tab
Questionnaires
AI FAQ
SIG Lite
Snyk API & Web
API & Web: BC Test
API & Web: DR Test
API & Web: Business Continuity Plan
API & Web: Disaster Recovery Plan
View 1 more
Business Continuity & Disaster Recovery
BC/DR Overview for Multi tenant
BC and DR Testing 2025.pdf
Other resources
Mandiant Security Memo on the Klue Incident
Cyber Insurance 2026
ISO Statement of Applicability
View 1 more
Subprocessors
View all
Amplitude, Inc.
•
Data analytics
Hosted in the U.S. May be accessed globally by Snyk employees.
Snyk uses Amplitude to obtain usage analytics in relation to its products and services. To compile these analytics, Amplitude may access personal data relating to a user’s use of Snyk’s services, their features and functionality. Snyk uses these analytics to optimize and improve its offerings.
Amazon Web Services (AWS)
•
IT
Data can be hosted in the U.S., EU or Australia at Customer’s election. May be accessed globally by Snyk employees.
SaaS Services hosting provider serving as the backbone of our infrastructure for several of our products and Services. AWS may have access to all Customer Data. However, as a general principle, AWS will not access any Customer instances of the Snyk Services except in limited cases such as to investigate service issues.
Akamai Technologies, Inc.
•
Engineering
The nature of the Akamai solution, for optimizing traffic management, means that Akamai processes Snyk’s customer data from the region closest to where the user is located.
SnykContent Delivery Network provider - Snyk uses the CDN for managing user traffic on its products and services. Developer personal data may be included in the short term data cache for this service.
Okta
•
IT
Hosted in the U.S, EU or Australia at Customer’s election. May be accessed globally by Snyk employees.
Auth0 serves as an identity provider which is used to authenticate users of Snyk’s services. To perform this authentication, Auth0 will have access to personal data of the users.
FAQ
View all
Updates
View all
General
Supply Chain Compromise Incident - Keyv / Cacheable ("ChainDrop") - Update #2
Published August 5, 2026
On August 4, 2026, Snyk identified a large-scale, active supply chain attack affecting the npm ecosystem, ultimately compromising 444 packages across multiple package families. The campaign has now stabilized, and Snyk's investigation and advisory coverage are complete.
Summary of the incident
The attack began with the compromise of a single maintainer's account and the first malicious releases, keyv@6.0.0 and cache-manager@7.2.10. The malware self-propagated using stolen npm publish credentials to inject itself into and republish additional packages across multiple maintainers' namespaces.
Current status
The campaign has stopped propagating; no new malicious publications have been observed.
The scope has converged to 444 compromised packages, and the affected packages and versions list is now complete, with Snyk advisories published across the full set.
Detection resources are live and finalized: the in-product Zero-Day report ("Active Security Incident Assessment for Keyv Supply Chain Compromise - Aug 2026") and the dedicated incident page listing all compromised packagesOpens in new tab.
Snyk is not impacted.
Recommended actions remain unchanged for any environment that may have installed a compromised version: remove affected versions, regenerate lockfiles, and rotate credentials from a trusted machine.
We consider this incident mitigated and will continue routine monitoring for any renewed activity. This page will be updated if the situation changes.
For additional background and technical details, see the Snyk Blog postOpens in new tab.
General
Supply Chain Compromise Incident - Keyv / Cacheable - Update #1
Published August 4, 2026
We are investigating an active supply chain compromise affecting multiple npm packages across several package families.
Current reporting indicates that a compromised maintainer account was used to publish malicious versions to the npm registry on August 4, 2026, beginning with keyv@6.0.0 and cache-manager@7.2.10. The malware self-propagates using stolen npm publish credentials to inject itself into and republish additional packages, and has spread to hundreds of packages across many projects. The affected package and version list continues to grow.
The malicious behavior includes credential harvesting from developer and CI/CD environments - npm, GitHub, cloud, and Vault credentials - and exfiltration to attacker-controlled infrastructure. It executes via both an npm preinstall script and IDE auto-run hooks (.claude/settings.json, .vscode/tasks.json), so simply opening an affected repository in an IDE or coding agent can trigger it.
Initial Snyk advisories have been published, and the investigation remains ongoing. At this time, there is no confirmed Snyk customer impact.
Snyk is not impacted.
We will continue to monitor the situation and update this page as more information becomes available.
For additional background and technical details, please refer to the Snyk Blog postOpens in new tab.
General
Closing Update - Third-Party Vendor Security Incident — Klue
Published July 8, 2026
Status: Investigation Complete — July 8, 2026
Snyk's forensic investigation into the June 2026 Klue/Salesforce incident is now complete. The investigation confirmed no impact beyond what was disclosed in our June 22 communications: business CRM data only (contact information, account details, sales and contract records, and support case titles and descriptions). Case comments, attachments, and the Snyk platform were not affected. All impacted customers were notified directly and the data involved is consistent with what was disclosed in our June 22 blog postOpens in new tab.
Documentation available upon request:
Mandiant Security Memo
Customer-specific data export
Questions: support@snyk.io
General
Third-Party Vendor Security Incident — Klue
Published June 19, 2026
Summary
Snyk is aware of a security incident at Klue, a third-party vendor we use for competitive intelligence. We were notified of a security incident involving Klue, a market intelligence platform used by Snyk and a wide range of companies for competitive intelligence. An unauthorized party accessed data from Snyk's Salesforce environment through Klue's integration. Other security vendors, such as Recorded FutureOpens in new tab, TaniumOpens in new tab, HuntressOpens in new tab, and JamfOpens in new tab have been impacted and have shared updates publicly.
Impact on Snyk products and services
This incident did not affect Snyk's products, and there was no impact on our ability to serve our customers. The Snyk platform, our scanning engines, and customer-facing services were not involved in any way.
Our response
After Klue notified us of the incident, we immediately disabled Klue's integration within Salesforce. We have engaged our security team to conduct an independent review, taken steps to protect our environment, and notified law enforcement. We have established the timeline of unauthorized access to our Salesforce environment and are reviewing what data was affected.
What's next
Our review is ongoing. We are treating this matter with the seriousness it warrants and have committed the people, time, and resources needed to understand its full scope. We will update this page as new information becomes available. Customers with questions can contact said.syed@snyk.io.