Contrarian View: DevSecOps Is Overhyped – Use Snyk 1.120 Only for Small Teams

#!/usr/bin/env python3
"""
Snyk Version Benchmark Tool
Compares scan performance and output between Snyk 1.120 and Snyk Enterprise 2.3.1
Requires: snyk 1.120.0 and snyk 2.3.1 installed, valid snyk auth token
"""

import subprocess
import json
import time
import argparse
import sys
import os
from pathlib import Path
from typing import Dict, List, Optional

# Configuration
SNYK_1_120_PATH = Path.home() / ".local/bin/snyk-1.120"
SNYK_ENTERPRISE_PATH = Path.home() / ".local/bin/snyk-2.3.1"
SUPPORTED_MANIFESTS = ["package.json", "requirements.txt", "go.mod", "pom.xml"]
SCAN_TIMEOUT = 300  # 5 minutes per scan

def run_snyk_scan(snyk_path: Path, manifest_path: Path, scan_args: List[str]) -> Optional[Dict]:
    """
    Run a Snyk scan on a given manifest file, return parsed JSON output or None on failure
    """
    if not snyk_path.exists():
        print(f"Error: Snyk binary not found at {snyk_path}", file=sys.stderr)
        return None

    cmd = [str(snyk_path), "test", str(manifest_path), "--json"] + scan_args
    try:
        start_time = time.perf_counter()
        result = subprocess.run(
            cmd,
            stdout=subprocess.PIPE,
            stderr=subprocess.PIPE,
            text=True,
            timeout=SCAN_TIMEOUT
        )
        elapsed = time.perf_counter() - start_time

        if result.returncode not in (0, 1):  # Snyk returns 1 if vulnerabilities found
            print(f"Scan failed with return code {result.returncode}: {result.stderr}", file=sys.stderr)
            return None

        scan_data = json.loads(result.stdout)
        scan_data["_scan_metadata"] = {
            "elapsed_seconds": elapsed,
            "snyk_version": subprocess.check_output([str(snyk_path), "--version"], text=True).strip(),
            "manifest_path": str(manifest_path)
        }
        return scan_data
    except subprocess.TimeoutExpired:
        print(f"Scan timed out after {SCAN_TIMEOUT}s for {manifest_path}", file=sys.stderr)
        return None
    except json.JSONDecodeError:
        print(f"Failed to parse JSON output from {snyk_path}", file=sys.stderr)
        return None

def count_critical_cves(scan_data: Dict) -> int:
    """Count number of critical severity vulnerabilities in scan results"""
    if "vulnerabilities" not in scan_data:
        return 0
    return sum(1 for vuln in scan_data["vulnerabilities"] if vuln.get("severity") == "critical")

def benchmark_repo(repo_path: Path) -> Dict:
    """
    Benchmark Snyk 1.120 vs Enterprise on a single repo
    """
    results = {
        "repo_path": str(repo_path),
        "snyk_1_120": {},
        "snyk_enterprise": {}
    }

    # Find all supported manifests in repo
    manifests = []
    for root, _, files in os.walk(repo_path):
        for file in files:
            if file in SUPPORTED_MANIFESTS:
                manifests.append(Path(root) / file)

    if not manifests:
        print(f"No supported manifests found in {repo_path}", file=sys.stderr)
        return results

    # Scan each manifest with both Snyk versions
    for manifest in manifests:
        print(f"Scanning {manifest}...")
        # Snyk 1.120 scan (no cloud features)
        v1_data = run_snyk_scan(SNYK_1_120_PATH, manifest, ["--ignore-policy", "--no-monitor"])
        if v1_data:
            results["snyk_1_120"][str(manifest)] = {
                "critical_cves": count_critical_cves(v1_data),
                "scan_time": v1_data["_scan_metadata"]["elapsed_seconds"],
                "vulnerabilities": len(v1_data.get("vulnerabilities", []))
            }

        # Snyk Enterprise scan (default features)
        v2_data = run_snyk_scan(SNYK_ENTERPRISE_PATH, manifest, [])
        if v2_data:
            results["snyk_enterprise"][str(manifest)] = {
                "critical_cves": count_critical_cves(v2_data),
                "scan_time": v2_data["_scan_metadata"]["elapsed_seconds"],
                "vulnerabilities": len(v2_data.get("vulnerabilities", []))
            }

    return results

def main():
    parser = argparse.ArgumentParser(description="Benchmark Snyk versions across repositories")
    parser.add_argument("--repos", nargs="+", required=True, help="Paths to repositories to benchmark")
    parser.add_argument("--output", default="benchmark_results.json", help="Output JSON file path")
    args = parser.parse_args()

    all_results = []
    for repo_path_str in args.repos:
        repo_path = Path(repo_path_str)
        if not repo_path.exists():
            print(f"Repo path {repo_path} does not exist, skipping", file=sys.stderr)
            continue
        repo_results = benchmark_repo(repo_path)
        all_results.append(repo_results)

    with open(args.output, "w") as f:
        json.dump(all_results, f, indent=2)
    print(f"Benchmark results written to {args.output}")

if __name__ == "__main__":
    main()

#!/bin/bash
"""
Snyk 1.120 CI Integration Script
For small teams (<8 engineers) using GitHub Actions/GitLab CI
Installs pinned Snyk 1.120.0, runs local scan, fails on critical CVEs
"""

set -euo pipefail  # Exit on error, undefined var, pipe failure

# Configuration
SNYK_VERSION="1.120.0"
SNYK_INSTALL_DIR="${HOME}/.snyk-bin"
SNYK_BINARY="${SNYK_INSTALL_DIR}/snyk"
MAX_CRITICAL_CVES=0  # Fail CI if any critical CVEs found
SLACK_WEBHOOK_URL="${SLACK_WEBHOOK_URL:-}"  # Optional Slack notification
SUPPORTED_EXTENSIONS=("json" "txt" "mod" "yaml" "yml")

# Error handling function
handle_error() {
    local exit_code=$?
    local line_no=$1
    echo "Error: Script failed at line ${line_no} with exit code ${exit_code}"
    if [[ -n "${SLACK_WEBHOOK_URL}" ]]; then
        curl -s -X POST -H 'Content-type: application/json' \
            --data "{\"text\":\"CI Security Scan Failed: Critical error at line ${line_no}\"}" \
            "${SLACK_WEBHOOK_URL}" > /dev/null
    fi
    exit ${exit_code}
}

trap 'handle_error ${LINENO}' ERR

# Check if Snyk 1.120 is installed, install if not
install_snyk() {
    if [[ -f "${SNYK_BINARY}" ]]; then
        local installed_version=$("${SNYK_BINARY}" --version | cut -d' ' -f3)
        if [[ "${installed_version}" == "${SNYK_VERSION}" ]]; then
            echo "Snyk ${SNYK_VERSION} already installed at ${SNYK_BINARY}"
            return 0
        fi
    fi

    echo "Installing Snyk ${SNYK_VERSION}..."
    mkdir -p "${SNYK_INSTALL_DIR}"
    local snyk_url="https://github.com/snyk/snyk/releases/download/v${SNYK_VERSION}/snyk-linux"
    curl -sL "${snyk_url}" -o "${SNYK_BINARY}"
    chmod +x "${SNYK_BINARY}"

    # Verify install
    local installed_version=$("${SNYK_BINARY}" --version | cut -d' ' -f3)
    if [[ "${installed_version}" != "${SNYK_VERSION}" ]]; then
        echo "Error: Installed Snyk version ${installed_version} does not match ${SNYK_VERSION}"
        exit 1
    fi
    echo "Successfully installed Snyk ${SNYK_VERSION}"
}

# Authenticate Snyk (uses SNYK_TOKEN env var)
auth_snyk() {
    if [[ -z "${SNYK_TOKEN:-}" ]]; then
        echo "Error: SNYK_TOKEN environment variable is not set"
        exit 1
    fi
    "${SNYK_BINARY}" auth "${SNYK_TOKEN}" --quiet
}

# Run Snyk scan on all supported manifests
run_scan() {
    local total_critical=0
    local scan_results="snyk_results.json"

    echo "Starting Snyk 1.120 scan..."
    # Find all supported manifest files
    local manifests=()
    while IFS= read -r -d '' file; do
        manifests+=("${file}")
    done < <(find . -type f \( -name "package.json" -o -name "requirements.txt" -o -name "go.mod" -o -name "pom.xml" \) -print0)

    if [[ ${#manifests[@]} -eq 0 ]]; then
        echo "No supported manifest files found, skipping scan"
        return 0
    fi

    # Run scan on all manifests, aggregate results
    echo "[" > "${scan_results}"
    local first=true
    for manifest in "${manifests[@]}"; do
        echo "Scanning ${manifest}..."
        local manifest_result
        manifest_result=$("${SNYK_BINARY}" test "${manifest}" --json --ignore-policy --no-monitor 2>/dev/null || true)

        # Parse critical CVEs
        local critical_count
        critical_count=$(echo "${manifest_result}" | jq '.vulnerabilities[]? | select(.severity == "critical") | .id' 2>/dev/null | wc -l)
        total_critical=$((total_critical + critical_count))

        if [[ "${first}" == "true" ]]; then
            first=false
        else
            echo "," >> "${scan_results}"
        fi
        echo "${manifest_result}" >> "${scan_results}"
    done
    echo "]" >> "${scan_results}"

    echo "Scan complete. Total critical CVEs found: ${total_critical}"

    # Fail CI if critical CVEs exceed threshold
    if [[ ${total_critical} -gt ${MAX_CRITICAL_CVES} ]]; then
        echo "Error: Found ${total_critical} critical CVEs, failing CI"
        if [[ -n "${SLACK_WEBHOOK_URL}" ]]; then
            curl -s -X POST -H 'Content-type: application/json' \
                --data "{\"text\":\"CI Security Scan Failed: ${total_critical} critical CVEs found\"}" \
                "${SLACK_WEBHOOK_URL}" > /dev/null
        fi
        exit 1
    fi

    echo "No critical CVEs found, CI scan passed"
}

# Main execution
main() {
    echo "Starting Snyk 1.120 CI Scan for small team..."
    install_snyk
    auth_snyk
    run_scan
    echo "Snyk CI scan completed successfully"
}

main

package main

import (
    "encoding/json"
    "fmt"
    "os"
    "io/ioutil"
    "path/filepath"
)

// SnykVulnerability represents a single vulnerability in Snyk JSON output
type SnykVulnerability struct {
    ID          string `json:"id"`
    Severity    string `json:"severity"`
    PackageName string `json:"packageName"`
    Version     string `json:"version"`
    CVSSScore   float64 `json:"cvssScore"`
}

// SnykScanResult represents the top-level Snyk test JSON output
type SnykScanResult struct {
    Vulnerabilities []SnykVulnerability `json:"vulnerabilities"`
    PackageManager  string `json:"packageManager"`
    ScanTime        float64 `json:"scan_time,omitempty"`
}

// CoverageReport compares vulnerability coverage between two Snyk versions
type CoverageReport struct {
    SnykV1Path      string
    SnykV2Path      string
    V1Critical      int
    V2Critical      int
    V1Total         int
    V2Total         int
    CoverageDiffPct float64
}

func loadScanResult(filePath string) (*SnykScanResult, error) {
    data, err := ioutil.ReadFile(filePath)
    if err != nil {
        return nil, fmt.Errorf("failed to read file %s: %w", filePath, err)
    }

    var result SnykScanResult
    if err := json.Unmarshal(data, &result); err != nil {
        return nil, fmt.Errorf("failed to parse JSON %s: %w", filePath, err)
    }

    return &result, nil
}

func countCriticalVulns(results []*SnykScanResult) int {
    total := 0
    for _, res := range results {
        for _, vuln := range res.Vulnerabilities {
            if vuln.Severity == "critical" {
                total++
            }
        }
    }
    return total
}

func countTotalVulns(results []*SnykScanResult) int {
    total := 0
    for _, res := range results {
        total += len(res.Vulnerabilities)
    }
    return total
}

func generateCoverageReport(v1Results []*SnykScanResult, v2Results []*SnykScanResult) CoverageReport {
    v1Critical := countCriticalVulns(v1Results)
    v2Critical := countCriticalVulns(v2Results)
    v1Total := countTotalVulns(v1Results)
    v2Total := countTotalVulns(v2Results)

    // Calculate coverage difference: (v2Critical - v1Critical) / v2Critical * 100
    coverageDiff := 0.0
    if v2Critical > 0 {
        coverageDiff = float64(v2Critical - v1Critical) / float64(v2Critical) * 100
    }

    return CoverageReport{
        V1Critical:      v1Critical,
        V2Critical:      v2Critical,
        V1Total:         v1Total,
        V2Total:         v2Total,
        CoverageDiffPct: coverageDiff,
    }
}

func printReport(report CoverageReport) {
    fmt.Println("========================================")
    fmt.Println("Snyk 1.120 vs Snyk Enterprise Coverage Report")
    fmt.Println("========================================")
    fmt.Printf("Snyk 1.120 Critical CVEs: %d\n", report.V1Critical)
    fmt.Printf("Snyk Enterprise Critical CVEs: %d\n", report.V2Critical)
    fmt.Printf("Snyk 1.120 Total CVEs: %d\n", report.V1Total)
    fmt.Printf("Snyk Enterprise Total CVEs: %d\n", report.V2Total)
    fmt.Printf("Coverage Difference: %.2f%%\n", report.CoverageDiffPct)

    if report.CoverageDiffPct < 5 {
        fmt.Println("✅ Snyk 1.120 covers >95% of critical CVEs compared to Enterprise")
    } else if report.CoverageDiffPct < 10 {
        fmt.Println("⚠️ Snyk 1.120 covers 90-95% of critical CVEs compared to Enterprise")
    } else {
        fmt.Println("❌ Snyk 1.120 covers <90% of critical CVEs compared to Enterprise")
    }
}

func main() {
    if len(os.Args) < 3 {
        fmt.Printf("Usage: %s  \n", filepath.Base(os.Args[0]))
        os.Exit(1)
    }

    v1Dir := os.Args[1]
    v2Dir := os.Args[2]

    // Load all JSON results from v1 directory
    v1Results := []*SnykScanResult{}
    err := filepath.Walk(v1Dir, func(path string, info os.FileInfo, err error) error {
        if err != nil {
            return err
        }
        if !info.IsDir() && filepath.Ext(path) == ".json" {
            res, err := loadScanResult(path)
            if err != nil {
                fmt.Printf("Warning: Failed to load %s: %v\n", path, err)
                return nil
            }
            v1Results = append(v1Results, res)
        }
        return nil
    })
    if err != nil {
        fmt.Printf("Error walking v1 directory: %v\n", err)
        os.Exit(1)
    }

    // Load all JSON results from v2 directory
    v2Results := []*SnykScanResult{}
    err = filepath.Walk(v2Dir, func(path string, info os.FileInfo, err error) error {
        if err != nil {
            return err
        }
        if !info.IsDir() && filepath.Ext(path) == ".json" {
            res, err := loadScanResult(path)
            if err != nil {
                fmt.Printf("Warning: Failed to load %s: %v\n", path, err)
                return nil
            }
            v2Results = append(v2Results, res)
        }
        return nil
    })
    if err != nil {
        fmt.Printf("Error walking v2 directory: %v\n", err)
        os.Exit(1)
    }

    if len(v1Results) == 0 || len(v2Results) == 0 {
        fmt.Println("Error: No scan results found in one or both directories")
        os.Exit(1)
    }

    report := generateCoverageReport(v1Results, v2Results)
    printReport(report)
}