appsec.fyi — Snyk

Snyk’s Fetch the Flag CTF is More Than Just a CTF

Wed, 01 Jul 2026 06:00:57 +0000

CTF challenges, like Snyk's Fetch the Flag, often mirror real-world vulnerabilities. Past events included "Protecting Camp," a challenge exploiting insecure access controls similar to Azure Power Apps misconfigurations; "Sparky," recreating CVE-2022-33891 in Apache Spark, a documented exploited vulnerability; and "GetHub," demonstrating RCE via command injection in the GitPython library (CVE-2022-24439), highlighting supply chain risks.

Snyk VulnBench JS 1.0: Can LLMs Find the Same Bugs Twice?

Tue, 30 Jun 2026 06:00:57 +0000

Library of tests for Snyk VulnBench JS 1.0, evaluating LLM security review repeatability by measuring consistency of findings on JavaScript code. The benchmark uses small Express applications and compares LLM outputs against Snyk Code SAST reference vulnerabilities, revealing that LLM-generated findings are inconsistently repeatable, particularly those outside the established reference set, unlike the deterministic output of traditional SAST tools.

What nearly 10,000 developer environments reveal about agentic development risk

Wed, 24 Jun 2026 06:00:51 +0000

Analysis of nearly 10,000 developer environments reveals significant risks in agentic development, with 43% of developers using multiple AI coding tools and 50.8% employing MCP servers. These configurations, along with agent skills (used by 22.8%), introduce a new supply chain layer where prompt injection findings and malicious code patterns are already present in active tooling. Traditional AppSec controls need expansion to govern these developer environments, as risks emerge before code commitment, impacting tools like Claude, Cursor, and VS Code extensions.

Announcing Agentic Development Security (ADS)

Wed, 24 Jun 2026 06:00:51 +0000

Library for Agentic Development Security (ADS) that secures AI-driven software development by embedding security directly into workflows. It provides visibility, governance, and control over tools agents use, their actions, and generated code. ADS addresses risks from dynamic, multi-step workflows and autonomous agent behavior, moving security from post-code analysis to real-time evaluation of agent supply chains, behavior, and generated code, preventing issues like the deletion of a production database by an AI agent with improper credentials and no guardrails.

Secure your software supply chain with the new Snyk Vulnerability Intelligence for SBOM ServiceNow integration

Tue, 23 Jun 2026 06:00:59 +0000

Integration that brings Snyk package vulnerability intelligence to SBOMs stored in ServiceNow. This tool identifies vulnerability severity within application and software package contexts, offering fix information and remediation guidance. It automates the creation of application vulnerable items in ServiceNow Vulnerability Response, enabling task assignment, progress tracking, and stakeholder notification. The integration aids in managing risks from zero-day vulnerabilities, such as recent http2 or curl vulnerabilities, and facilitates the analysis of third-party SBOMs for pre-deployment vulnerability assessment.

Our favorite 2023 Snyk Fetch the Flag CTF writeups from the community

Tue, 23 Jun 2026 06:00:57 +0000

Writeups of the 2023 Snyk Fetch the Flag CTF challenges offer insights into solving over 30 hacking puzzles, including web exploitation and cryptography. These community-contributed analyses detail approaches to challenges like "Quick Maths," "GetHub," and "You Wouldn’t Steal A /Flag.txt," providing practical learning opportunities for cybersecurity enthusiasts.

Exploring WebExtension security vulnerabilities in React Developer Tools and Vue.js devtools

Tue, 23 Jun 2026 06:00:56 +0000

Writeup detailing WebExtension security vulnerabilities discovered in React Developer Tools (CVE-2023-5654) and Vue.js devtools (CVE-2023-5718). The research highlights risks such as unverified external messages allowing arbitrary URL fetching via `fetch()`, and unauthorized access to page capture APIs enabling sensitive data leakage through base64 encoded screenshots. The analysis explores the WebExtension architecture and specific pitfalls leading to these findings.

Nightfall AI and Snyk unite to deliver AI-powered secrets scanning for developers

Mon, 22 Jun 2026 06:00:59 +0000

Library integrating Nightfall AI's advanced secrets scanning with Snyk's developer security platform. This partnership enables automated detection of PII, PHI, PCI, API keys, and other sensitive data across cloud environments and AI-generated code. Nightfall's AI-native capabilities offer over 100 data type detectors, context-aware alerts to reduce false positives, and developer-centric remediation, enhancing Snyk's ability to secure the software supply chain and application security posture.

Snyk Fetch the Flag CTF 2023 writeup: Audiopolis

Mon, 22 Jun 2026 06:00:58 +0000

Writeup of the Audiopolis challenge from Snyk's Fetch the Flag CTF 2023, detailing a command injection vulnerability in a speech-to-text web application. The writeup explains how to exploit the application by crafting malicious `.wav` files using the `text2wave` program to achieve command execution, ultimately leading to the discovery of the flag.

Snyk Fetch the Flag CTF 2023 writeup: Silent Cartographer

Mon, 22 Jun 2026 06:00:58 +0000

Writeup of the Silent Cartographer challenge from Snyk's Fetch the Flag CTF 2023, detailing the exploitation of the Covenant C2 framework. This challenge involves identifying the vulnerable application, leveraging known exploits for default JWT secret key leakage in Covenant versions prior to 0.5, and fabricating a JWT to gain administrator privileges. The writeup further addresses the practical challenge of binding the exploit's new listener to port 80, necessitating the use of a tunneler like Ngrok for successful reverse shell handling.

Snyk Fetch the Flag CTF 2023 writeup: Protect The Environment

Mon, 22 Jun 2026 06:00:57 +0000

Writeup of Snyk's Fetch the Flag CTF 2023 "Protect The Environment" challenge, detailing a file inclusion vulnerability. The solution involves bypassing a custom base64 encoding layer on paths to include the `/proc//environ` file, exploiting Flask's inability to correctly chroot static files. The writeup notes that PID 1 or enumerated PIDs like 8 (used by Gunicorn workers) are viable targets.

Snyk Fetch the Flag CTF 2023 writeup: Honey Baked Messages

Mon, 22 Jun 2026 06:00:57 +0000

Writeup of Snyk Fetch the Flag CTF 2023 "Honey Baked Messages" challenge, detailing the solution involving Hamming codes. The process includes understanding (7, 4) Hamming codes, reading input lines, determining the required parity check matrix (H matrix), and performing error correction on the entire file to extract the flag. A Python script demonstrates the complete solve.

Snyk Fetch the Flag CTF 2023 writeup: I Do Math

Mon, 22 Jun 2026 06:00:57 +0000

Writeup of Snyk Fetch the Flag CTF 2023's "I Do Math" challenge, detailing the solution for successful login. Players must authenticate as "admin" with the pin 9007199254740992, which represents JavaScript's MAX_SAFE_INT value. Numbers outside this range prevent successful access.

Snyk Fetch the Flag CTF 2023 writeup: Off the SETUID

Mon, 22 Jun 2026 06:00:57 +0000

Writeup detailing the "Off the SETUID" challenge from Snyk's Fetch the Flag CTF 2023. The solution involves exploiting a PHP code injection vulnerability in an HTTP server to gain initial access, followed by a kernel privilege escalation. The escalation leverages a custom `fun_setuid` syscall with a design flaw allowing a NULL pointer dereference, enabling root privileges by manipulating kernel credentials. The writeup also introduces the `memexec` tool for fileless execution of binaries within PHP environments.

Top 3 security best practices for handling JWTs

Mon, 22 Jun 2026 06:00:55 +0000

Guide on securing JSON Web Tokens (JWTs) detailing three core best practices. It emphasizes keeping JWTs secret through HTTPS, HttpOnly/Secure cookie flags, and secure browser storage, while highlighting the risks of XSS. The guide stresses the importance of robust JWT validation, including signature verification, and checking claims like expiration, issuer, and audience. It also advocates for setting expiration times on JWTs to limit their usability and prevent unauthorized access. The article mentions tools like Snyk for identifying vulnerabilities and libraries such as Flask-JWT-Extended and PyJWT for implementation.

Kroger’s approach to supply chain security

Sun, 21 Jun 2026 06:00:59 +0000

Library integrating a shift-left approach to software supply chain security, utilizing Snyk Code and APIs for proactive vulnerability detection and SBOM generation. Kroger’s implementation emphasizes developer efficiency and risk management, with features that scan pull requests, alert on suspicious package downloads, and automate compliance for PCI DSS 4.0 requirements. The platform supports the company’s efforts in navigating complex technology stacks and addressing open-source dependency risks.

Build and deploy a Node.js security scanning API to Platformatic Cloud

Sun, 21 Jun 2026 06:00:59 +0000

Library for building a Node.js security scanning API using Platformatic and Fastify. This resource details how to scaffold a Node.js service with Platformatic, integrate the Snyk CLI and API for vulnerability detection, and create a POST endpoint to test npm packages. It emphasizes securing API tokens using environment variables and IDE extensions like the Snyk VS Code extension for secret detection.

3 tips from Snyk and Dynatrace’s AI security experts

Sun, 21 Jun 2026 06:00:57 +0000

Talk from Snyk and Dynatrace AI experts highlights three key takeaways for secure generative AI adoption. Prioritizing AI governance, involving cross-functional teams for ethics, request ingestion, and communication is crucial. Taking a patient and considered approach to new technologies is advised, with a focus on understanding data flow, explainability, and transparency in AI tools. Finally, balancing AI opportunities with risks in development necessitates rigorous code security practices, including threat management scanning and clear documentation of AI-generated code, to avoid vulnerabilities and data overexposure.

Snyk & Atlassian: How to embed security in AI-assisted software development

Sun, 21 Jun 2026 06:00:56 +0000

Library that integrates with AI-assisted development to address risks from tools like GitHub Copilot and Amazon CodeWhisperer. It scans AI-generated code in real-time within the IDE, flagging vulnerabilities stemming from bad training data or hallucinations, and provides quick fixes. The library is presented as a method to verify code against known standards, ensuring trust and security are embedded throughout the SDLC, much like safety measures on a construction site.

Essential AI Tools to Boost Developer Productivity and Security

Sat, 20 Jun 2026 06:01:06 +0000

Library that categorizes AI developer tools, highlighting Security Companions like Snyk Code for real-time analysis of AI-generated and developer-written code. It also details Coding Assistants (GitHub Copilot, Amazon CodeWhisperer), Chatbots/LLMs (ChatGPT, Claude.AI), AI code search (Sourcegraph, Phind), and AI code testing (Codium), emphasizing the need to pair coding assistants with security tools.

How Snyk ensures safe adoption of AI

Sat, 20 Jun 2026 06:01:05 +0000

Library that uses DeepCode AI, a hybrid approach combining symbolic and machine learning AI, to secure AI-generated code. This technology analyzes code in real-time within the IDE, identifying vulnerabilities like those introduced by tools such as Copilot. It provides accurate results with reduced false positives by incorporating multi-file, interfile, and dataflow analysis, and offers AI-generated fix candidates that are validated for security before recommendation, mitigating risks of license infringement, IP violations, and software vulnerabilities.

Securing your SBOM on Google Cloud

Sat, 20 Jun 2026 06:01:04 +0000

Guidance on securing SBOMs details NSA recommendations for open source software management, secure repository creation, and crisis management. Practices include evaluating OSS, risk assessment, maintaining internal repositories, vulnerability response, and creating validated SBOMs with details on components, versions, and licenses. Snyk integrates with Google Cloud services like CloudBuild, Artifact Registry, and GKE to help users find and fix vulnerabilities, scan containers, and generate enriched SBOMs.

Introducing Snyk’s partnership with Gemini Code Assist

Sat, 20 Jun 2026 06:01:04 +0000

Library integrating Snyk's security expertise with Google Gemini's AI coding assistance. This partnership delivers automated fixes and in-line security feedback for AI-generated code within IDEs like Google Cloud Code, providing full application context to identify vulnerabilities early. It leverages DeepCode AI for SAST and aims to accelerate development velocity without compromising security, allowing teams to adopt AI coding assistants confidently.

DevOpsDays Singapore 2024: Unmasking the security pitfalls in AI-generated code

Fri, 19 Jun 2026 06:01:06 +0000

Talk from DevOpsDays Singapore 2024 highlights security challenges in AI-generated code. Tools like Copilot, AWS Code Whisperer, and Gemini can increase development speed but may introduce vulnerabilities such as SQL injection and XSS, or use outdated libraries. An analysis showed 40% of Copilot-generated code had flaws. Live demonstrations illustrated how AI can both introduce and help fix these security issues with proper prompting. Security tools like Snyk, integrating into development environments, are crucial for scanning and remediating these vulnerabilities early in the SDLC.

More accurate than GPT-4: How Snyk’s CodeReduce improved the performance of other LLMs

Fri, 19 Jun 2026 06:01:06 +0000

Library that enhances LLM performance for security vulnerability autofixing. It employs proprietary CodeReduce technology, which utilizes program analysis to narrow the LLM's attention to critical code snippets, significantly improving fix generation accuracy and speed. This approach addresses LLM limitations by focusing on curated security fix datasets and contextual code, outperforming existing models like GPT-4 on various vulnerability types including AST, Local, FileWide, SecurityLocal, and SecurityFlow issues.

Secure AI tool adoption: Perceptions and realities

Fri, 19 Jun 2026 06:01:04 +0000

Survey of 459 IT professionals globally, including AppSec, developers, and C-suite, reveals that while organizations feel ready for generative AI coding tools, less than 20% conduct formal POCs. Security fears are the biggest adoption barrier, yet AppSec teams express greater concern about AI code security and insufficient policies compared to management. The report highlights a discrepancy in AI readiness perceptions across roles, with leadership being more optimistic than those directly involved with code.

Securing next-gen development: Lessons from Trust Bank and TASConnect

Fri, 19 Jun 2026 06:01:04 +0000

Talk from Black Hat Asia featuring experts from Trust Bank and TASConnect, discussing strategies for securing next-generation applications. It highlights the challenges posed by complex architectures, AI-generated code (like that from GitHub Copilot and Google Gemini), and multi-cloud deployments. The session emphasizes a proactive, developer-first approach, leveraging tools such as Snyk for immediate feedback and risk prioritization, and tracking key metrics like security training implementation and time to remediate to align security with business goals.

The full Snyk AI Security Platform, free for open source maintainers

Fri, 19 Jun 2026 06:01:03 +0000

Platform offering open source maintainers free access to the Snyk AI Security Platform. It focuses on issue prioritization using exploitability, reachability, and asset criticality, alongside automated fix pull requests for vulnerable dependencies via the Snyk Remediation Agent, which uses frontier-model reasoning for validated, merge-ready fixes in Snyk Open Source and Snyk Code.

Snyk Code now secures AI builds with support for LLM sources

Thu, 18 Jun 2026 06:01:05 +0000

Library updates for Snyk Code now secure AI builds by tracking data flows from LLM libraries, including those from OpenAI, HuggingFace, Anthropic, and Google. This enhancement performs taint analysis on data returned from LLM sources, treating it as untrusted by default, to detect vulnerabilities such as prompt injections, SQL injection, and XSS. The tool identifies unsanitized data sinking into sensitive functions or data stores, alerting users to potential security issues even in projects with initially unsupported LLM frameworks.

Finding and fixing exposed hardcoded secrets in your GitHub project with Snyk

Thu, 18 Jun 2026 06:01:04 +0000

Library for scanning Node.js projects for exposed hardcoded secrets and credentials, demonstrated with the Snyk goof project. It utilizes Snyk to identify vulnerabilities and then refactors code to leverage Doppler for centralized secret management, preventing secrets from being pushed to GitHub and enabling environment-specific configurations. The process involves adding secrets to Doppler and updating application code to use environment variables injected via the Doppler CLI.

A security expert’s view on Gartner’s generative AI insights - Part 2

Thu, 18 Jun 2026 06:01:02 +0000

Library for AI-driven application security, Snyk Agent Fix integrates into IDEs for real-time autofixing, leveraging a specialized, proprietary LLM trained on security data rather than general code functionality. This approach ensures more reliable security fixes than those from general-purpose LLMs. The library aims for accuracy and speed, catering to both developer and security teams, and includes features like SBOM generation and proactive risk neutralization, as demonstrated by its early discovery of the Leaky Vessels zero-day vulnerability.

Dive into AI and LLM learning with the new Snyk Learn learning path

Wed, 17 Jun 2026 06:01:07 +0000

Library provides a free learning path on Snyk Learn, focusing on the OWASP Top 10 for LLMs and GenAI. This path addresses critical security challenges in AI systems, including prompt injection and sensitive information disclosure, equipping developers and security professionals with knowledge to secure AI-driven applications.

Proactive AppSec continuous vulnerability management for developers and security teams

Wed, 17 Jun 2026 06:01:05 +0000

Library for continuous vulnerability management that integrates Snyk DeepCode AI into IDEs like VS Code and IntelliJ IDEA. It proactively identifies security issues in open-source components, AI-generated code (e.g., from GitHub Copilot), and containerized applications, offering real-time feedback and mitigations for vulnerabilities like XSS and SQL injection, thereby enhancing application security throughout the development lifecycle.

Foundations of trust: Securing the future of AI-generated code

Tue, 16 Jun 2026 06:01:02 +0000

Program that partners with AI coding assistants like Codieum, Tabnine, TabbyML, and Qodo to integrate Snyk's security capabilities. This initiative addresses vulnerabilities common in AI-generated code, such as inaccuracies, hallucinations, security flaws, data poisoning, and prompt injections. By embedding real-time SAST guardrails and automated remediation through DeepCode AI Fix into IDE extensions, the program aims to secure AI-assisted development workflows and increase trust in AI-generated software.

Automatically fix code vulnerabilities with AI

Tue, 16 Jun 2026 06:01:01 +0000

Library for automatically fixing common security vulnerabilities, such as Cross-site Scripting (XSS) in Java applications, by leveraging a hybrid AI model. This tool, integrated into IDEs, goes beyond providing remediation advice by directly applying secure code fixes, exemplified in a Spring Boot application using the Thymeleaf template engine and the faker library. Unlike generative AI assistants that may introduce insecure code, this library uses a combination of generative AI, symbolic AI, and machine learning, trained on curated security research data, to ensure secure code generation.

Find, auto-fix, and prioritize intelligently, with Snyk's AI-powered code security tools

Tue, 16 Jun 2026 06:01:00 +0000

Library for AI-powered application security, Snyk Code, offers automated detection and remediation of vulnerabilities. Utilizing DeepCode AI, it scans code directly within the IDE, providing rapid SAST analysis and auto-fixing suggestions via its Snyk AgentFix feature. This multi-model AI approach combines different methodologies for enhanced reliability, ensuring suggested fixes are screened by symbolic AI before developer application, reducing mean-time-to-remediate and improving code security for AI-generated code.

Top 5 SAST Auto-fixing Tools and How They Compare

Tue, 16 Jun 2026 06:00:59 +0000

Library comparing the top 5 SAST auto-fixing tools, focusing on AI-powered, private, and accurate remediation. It highlights features like automated fixes, seamless integration into developer workflows, and compatibility with detection tools, referencing Snyk Agent Fix as an example of a self-hosted LLM trained on secure code to accurately address vulnerabilities without introducing new risks.

Lottie Player npm package compromised for crypto wallet theft

Tue, 16 Jun 2026 06:00:59 +0000

Writeup detailing the compromise of the `@lottiefiles/lottie-player` npm package, which injected malicious code into versions 2.0.5 through 2.0.7, enabling cryptocurrency wallet theft. The incident highlights supply chain risks, particularly when using CDNs without pinned dependency versions, and details how tools like Snyk can identify vulnerable installations of this and similar packages.

Extending developer security with dev-first dynamic testing

Tue, 16 Jun 2026 06:00:59 +0000

Library extending developer security, Snyk has acquired Probely, a provider of API Security Testing and Dynamic Application Security Testing (DAST). This acquisition integrates modern DAST capabilities, focusing on a developer-first approach with low false positive rates, simple implementation, and CI/CD pipeline integration, addressing the growing need for API security in the GenAI era and providing enhanced visibility into application risk.

Securing GenAI Development with Snyk

Mon, 15 Jun 2026 06:00:55 +0000

Ebook detailing how to secure GenAI development with Snyk. It addresses the risks of AI-generated code, where up to 40% from tools like Copilot can contain security flaws, and the speed at which CVEs can be exploited. The ebook explains how Snyk Code, with its DeepCode AI and Snyk Agent Fix, offers in-IDE security, real-time scanning, AI-driven auto-fixing, and faster scans compared to traditional solutions, balancing productivity with robust security for both human-written and AI-generated code.

Snyk Security Labs Testing Update: Cursor.com AI Code Editor

Mon, 15 Jun 2026 06:00:54 +0000

Analysis of Cursor.com AI Code Editor by Snyk Security Labs details testing for dependency confusion vulnerabilities. Researchers uploaded intentionally named packages to the public NPM repository to test if Cursor's build system would mistakenly pull private extensions from the public registry. These packages exfiltrated system details such as username, hostname, and environmental variables to confirm installation. The analysis concluded that Cursor was not vulnerable to dependency confusion and no sensitive data was disclosed.

Sneak Peek into Fetch the Flag CTF 2025

Mon, 15 Jun 2026 06:00:54 +0000

Workshop slides from Fetch the Flag CTF 2023, featuring challenges like Beep64, Quick Maths, Ominous, GetHub, Sparky, and Bedsheets. This event, hosted by Snyk and John Hammond, offers 20+ hands-on hacking challenges for all skill levels, with prizes including Meta Quest 3S VR headsets. A CTF 101 Workshop is also available on February 13, 2025, for beginners.

Creating SBOMs with the Snyk CLI

Sun, 14 Jun 2026 06:00:57 +0000

Library for generating Software Bills of Materials (SBOMs) using the Snyk CLI. It supports various programming languages and package managers, creating SBOMs in CycloneDX, XML, or SPDX formats. The Snyk CLI can also scan existing SBOM files for known vulnerabilities and integrates with tools like Bomber for analysis. Automating SBOM generation within CI/CD pipelines is crucial for security, compliance, and transparency.

Consolidate Security Findings with Snyk and Google Security Command Center

Sun, 14 Jun 2026 06:00:57 +0000

Integration between Snyk and Google Security Command Center consolidates application and cloud security findings into a single view. This allows CISOs and security teams to monitor Snyk-detected application vulnerabilities, such as critical issues in open-source libraries within container images, alongside cloud security issues identified by Security Command Center. The integration streamlines risk management, enables near real-time detection, and prioritizes remediation by providing actionable advice from Snyk alongside Google's threat intelligence and Mandiant's expertise.

Solving Security Challenges with Snyk Code and Symbolic AI

Sun, 14 Jun 2026 06:00:56 +0000

Library that leverages Symbolic AI for static application security testing (SAST). Snyk Code analyzes code paths to detect vulnerabilities, outperforming traditional pattern-matching methods. It successfully identified open redirects in Python Flask applications, and Server-Side Request Forgery (SSRF), Cross-Site Scripting (XSS), and CRLF injection in Node.js Express applications. Snyk Code not only detects these issues but also offers suggested fixes and contextual best practices.

Can Snyk Detect JWT Security Issues?

Sun, 14 Jun 2026 06:00:56 +0000

Library that analyzes Node.js applications for insecure JSON Web Token (JWT) usage, specifically identifying the misuse of `jsonwebtoken`'s `jwt.decode()` function, which can lead to broken authentication vulnerabilities. It also flags hardcoded secrets, insufficient logging, lack of rate limiting, and missing token expiration enforcement.

Learn about API security risks with the new Snyk Learn Learning Path

Sun, 14 Jun 2026 06:00:55 +0000

Learning path from Snyk Learn addresses the OWASP Top 10 for API security risks. This interactive resource provides developers and security teams with a deep understanding of critical API vulnerabilities and actionable strategies for mitigation. It covers real-world scenarios to fortify API security, complementing existing learning paths on OWASP Top 10 and GenAI & LLM risks.

Snyk Helps Secure the Golang Bento Project

Sun, 14 Jun 2026 06:00:54 +0000

Library contribution that fixes CVE-2025-22869, a denial-of-service vulnerability in golang.org/x/crypto/ssh, within the Golang Bento project. Snyk proactively addressed the issue by updating dependencies to secure versions, demonstrating their commitment to securing open-source projects through their Secure Developer Program.

Snyk and ServiceNow: Streamlining Vulnerability Management with ServiceNow VR Assignment Rules

Sun, 14 Jun 2026 06:00:54 +0000

Reference for leveraging ServiceNow Vulnerability Assignment rules to automate the routing of application vulnerabilities. The integration correlates vulnerability data with Configuration Management Database (CMDB) fields, enabling automatic assignment to the responsible developer teams based on application tags. This streamlines remediation workflows and enhances visibility for application security teams and CISOs.

Unburdening Developers From Vulnerability Fatigue with Snyk Delta Findings

Sun, 14 Jun 2026 06:00:53 +0000

Library for the Snyk VS Code extension that enhances developer workflows by introducing "delta findings." This feature allows developers to see only security issues introduced by their current code changes, filtering out noise from the base branch. It supports proactive remediation of vulnerabilities like command injection and cross-site scripting in JavaScript and Python code. The extension integrates with Snyk Code, Snyk Open Source, and Snyk IaC, offering AI-powered auto-fixing and granular filtering by severity and source.