# snyk-iac Published articles for snyk-iac. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## The full Snyk AI Security Platform, free for open source maintainers DevFeed: [The full Snyk AI Security Platform, free for open source maintainers]() Original publisher: [Read original article]() Author: Brendan Hann Published: 2026-06-18T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Maintainers](), [Open Source](), [Security](), [vulnerability](), [open-source-security](), [Artificial Intelligence](), [Frontier Model](), [Remote Access Trojan](), [AI Infrastructure]() Tags: [agent](), [ai](), [ai-infrastructure](), [ai-security](), [article](), [awareness](), [bugs](), [developer](), [enablement](), [engineering](), [frontier-model](), [interest](), [maintainers](), [open-source](), [open-source-security](), [remote-access-trojan](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-team](), [software](), [supply-chain-security](), [vulnerability](), [vulnerability-insights]() ### AI overview Snyk's Secure Developer Program gives qualifying open source projects free access to the Snyk AI Security Platform. It is designed to help maintainers prioritize real vulnerability reports and produce validated, merge-ready fixes through the Snyk Remediation Agent. ### Source excerpt Open source maintainers are drowning in real vulnerability reports and need help prioritizing, fixing, and shipping remediation faster. Snyk's Secure Developer Program gives qualifying projects free access to the Snyk AI Security Platform. ## JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up? DevFeed: [JPMorgan Just Published a Cyber To-Do List and Snyk Covers 8 of the 10 Items. How do you stack up?]() Original publisher: [Read original article]() Author: John Carione Published: 2026-04-23T00:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Resilience](), [Security](), [snyk-iac](), [supply-chain-security](), [vulnerability](), [Infrastructure as code](), [Open Source](), [AI Development](), [releases](), [pull-requests](), [Code]() Tags: [ai](), [ai-development](), [awareness](), [blog](), [cloud-security](), [code](), [contentlab](), [developer](), [devops](), [executive](), [iac-security](), [interest](), [open-source](), [open-source-security](), [pull-requests](), [releases](), [resilience](), [sbom](), [secrets](), [security](), [snyk-cloud](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [supply-chain-security](), [vulnerability]() ### AI overview JPMorganChase's 10-point cyber resilience checklist addresses enterprise security priorities spanning software versions, open-source dependencies, SBOMs, build pipelines, secrets, infrastructure as code, and AI development. The article explains how Snyk covers eight of the ten actions through developer workflows and its security platform. ### Source excerpt JPMorganChase published a 10-point cyber resilience checklist. See how Snyk covers 8 of the 10 actions and where it fits in your security stack. ## How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science DevFeed: [How Snyk Helps Federal Agencies Prepare for the Genesis Mission Era of AI-Driven Science]() Original publisher: [Read original article]() Author: Phoebe Nerdahl Published: 2025-12-09T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security](), [CI/CD]() Tags: [ai](), [awareness](), [blog](), [ci-cd](), [cloud](), [container-security](), [containers](), [cybersecurity](), [data](), [datasets](), [developers](), [executive](), [government](), [iac-security](), [infrastructure-as-code](), [open-source](), [open-source-security](), [research](), [science](), [security](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [software](), [supply-chain]() ### AI overview Snyk explains how federal agencies can secure AI-driven scientific software, data pipelines, cloud resources, and software supply chains for the Genesis Mission. ### Source excerpt Snyk helps Federal Agencies secure software for the White House's Genesis Mission, accelerating AI-driven science. Implement Secure by Design for the supply chain, cloud, and pipelines. ## Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers DevFeed: [Run AutoMCP To Supercharge Your AI Agent with Libraries MCP Servers]() Original publisher: [Read original article]() Author: Liran Tal Published: 2025-12-03T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [MSP MCP](), [Vulnerabilities](), [cursor](), [Node.js]() Tags: [agentic-coding](), [ai](), [ai-agent](), [application-security](), [awareness](), [blog](), [ci-cd](), [developer](), [devrel](), [devsecops](), [engineering](), [javascript](), [mcp](), [mcp-server](), [node-js](), [sbom](), [scm](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [vs-code](), [vulnerabilities]() ### AI overview A tutorial on using AutoMCP to configure Model Context Protocol servers for AI coding tools, connecting dependency context and Snyk scanning to AI-assisted development. ### Source excerpt Supercharge your AI agent! Learn how AutoMCP integrates Model Context Protocol (MCP) servers and Snyk Studio for secure, context-aware AI-driven development. ## Automated Package-Publication Incident IndonesianFoods in the NPM Ecosystem Linked to Crypto Reward-Farming Scam DevFeed: [Automated Package-Publication Incident IndonesianFoods in the NPM Ecosystem Linked to Crypto Reward-Farming Scam]() Original publisher: [Read original article]() Author: Stephen Thoemmes Published: 2025-11-13T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [incident](), [Boilerplate]() Tags: [automation](), [awareness](), [blog](), [code-security](), [container-security](), [cryptocurrency](), [developer](), [ecosystem](), [incident](), [next-js](), [npm-packages](), [open-source-security](), [publication](), [scam](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [supply-chain-security]() ### AI overview The article examines a large-scale surge of similarly structured NPM package publications linked to a dormant automation script associated with a cryptocurrency reward-farming scheme. It reports no verified active exploit and says the packages currently pose minimal risk, while emphasizing dependency hygiene and registry safeguards. ### Source excerpt In November 2025, a large-scale surge of package publications on the NPM registry with similar structures and naming patterns was discovered. Understand the details of the incident. ## Snyk Named a Leader in the 2025 Gartner® Magic Quadrant™ for Application Security Testing DevFeed: [Snyk Named a Leader in the 2025 Gartner® Magic Quadrant™ for Application Security Testing]() Original publisher: [Read original article]() Author: Ben Desjardins Published: 2025-10-14T04:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [Testing](), [sdlc](), [snyk-platform](), [Artificial Intelligence]() Tags: [ai](), [application-security](), [awareness](), [blog](), [build](), [executive](), [gartner](), [sdlc](), [security](), [snyk](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [testing]() ### AI overview Snyk announces that it was recognized as a Leader in the 2025 Gartner Magic Quadrant for Application Security Testing. The article highlights Snyk's developer-first approach, coverage across the modern SDLC, AI-powered remediation, integrations with developer workflows, and security controls for AI-related risks and untrusted LLM outputs. ### Source excerpt Snyk is recognized as a Leader in the 2025 Gartner® Magic Quadrant™ for Application Security Testing (AST), validating our developer-first approach and comprehensive platform for securing the modern SDLC. ## Understanding CRA Compliance: Overcoming Challenges with an Integrated Security Testing Approach DevFeed: [Understanding CRA Compliance: Overcoming Challenges with an Integrated Security Testing Approach]() Original publisher: [Read original article]() Author: Snyk Team Published: 2025-06-25T23:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [Testing](), [vulnerability management](), [DevOps](), [Tooling](), [Vulnerabilities](), [Development](), [Open Source]() Tags: [awareness](), [best-practices](), [blog](), [community](), [compliance](), [cra-requirements](), [cyber-resilience-act](), [cybersecurity](), [dependencies](), [deployment](), [developer](), [developers](), [development](), [devops](), [engineering](), [eu](), [scanners](), [secure-by-design](), [security](), [snyk-code](), [snyk-iac](), [snyk-learn](), [snyk-open-source](), [testing](), [vulnerabilities](), [vulnerability](), [vulnerability-management](), [workflows]() ### AI overview This article explains how the Cyber Resilience Act (CRA) changes software delivery expectations for organizations serving the EU. It highlights continuous security validation across proprietary code, open source libraries, and third-party dependencies, and recommends integrated security testing, secure-by-design practices, aligned teams, modern tooling, and security embedded in daily development workflows. ### Source excerpt Learn how to meet CRA requirements with integrated security testing, secure-by-design workflows, and scalable practices for modern dev teams. ## Snyk Partners with Nova8 to Empower Secure Development Across Latin America DevFeed: [Snyk Partners with Nova8 to Empower Secure Development Across Latin America]() Original publisher: [Read original article]() Author: Michael Daniels Published: 2025-04-15T04:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [snyk](), [Development](), [Cybersecurity](), [Security](), [Vulnerabilities](), [Cloud](), [DevOps](), [Architecture & Design](), [Open Source]() Tags: [application-security](), [awareness](), [blog](), [cloud-native](), [cybersecurity](), [developer](), [developer-security-platform](), [developers](), [devops](), [external](), [open-source](), [partners](), [partnership](), [security](), [snyk](), [snyk-code](), [snyk-container](), [snyk-iac](), [vulnerabilities]() ### AI overview Snyk announces a strategic partnership with Nova8 to expand developer security adoption across Latin America. The partnership combines Snyk's developer security platform with Nova8's regional distribution, implementation, training, customization, and channel-partner expertise to help organizations identify and fix application vulnerabilities earlier. ### Source excerpt Snyk joins forces with cybersecurity distributor Nova8 to accelerate developer security adoption in Latin America. See how the partnership helps reduce risk. ## 3 best practices to make the most of Snyk AppRisk Essentials DevFeed: [3 best practices to make the most of Snyk AppRisk Essentials]() Original publisher: [Read original article]() Author: Daniel Berman Published: 2024-09-19T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [App](), [snyk-iac]() Tags: [acquisition](), [applications](), [aspm](), [best-practices](), [blog](), [convert-paid](), [devops](), [devsecops](), [enterprise](), [executive](), [management](), [pmm](), [security](), [snyk-apprisk](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source]() ### AI overview Snyk AppRisk Essentials is being included in the Snyk Enterprise plan. The article describes application asset discovery, coverage management, ownership and criticality tracking, and policies for managing coverage. ### Source excerpt We're excited to announce that Snyk AppRisk Essentials is rolling out for all Snyk Enterprise Plan customers. ## How to secure an S3 bucket on AWS? DevFeed: [How to secure an S3 bucket on AWS?]() Original publisher: [Read original article]() Author: Liran Tal Published: 2024-07-12T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Amazon S3](), [Security & compliance, Cloud security](), [Encryption](), [Vulnerabilities](), [Logging](), [Monitoring](), [Terraform]() Tags: [acquisition](), [aws](), [best-practices](), [blog](), [blog-post](), [cloud-security](), [devops](), [devrel](), [encryption](), [how-to](), [logging](), [monitoring](), [s3](), [security](), [snyk-cloud](), [snyk-iac](), [terraform](), [vulnerabilities]() ### AI overview This article explains how to secure Amazon S3 buckets on AWS. It covers risks from public or misconfigured permissions, unencrypted data, and insufficient logging and monitoring, along with practical security and compliance practices and automation with Snyk. ### Source excerpt In this blog post, we'll discuss practical steps to ensure your S3 buckets are secure and compliant with best practices. ## Automatic source locations with Rego DevFeed: [Automatic source locations with Rego]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt Published: 2024-02-12T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [opa](), [snyk-iac](), [Infrastructure as code](), [Open Policy Agent](), [AWS CloudFormation](), [Terraform]() Tags: [blog](), [blog-post](), [cloud-security](), [cloudformation](), [developer](), [devops](), [engineering](), [iac](), [opa](), [rego](), [snyk](), [snyk-iac](), [technical]() ### AI overview This technical Snyk article explains automatic source code locations for Rego policy violations in Snyk IaC. The feature reports accurate file, line, and column information, including for custom rules. A simplified proof of concept uses CloudFormation YAML, Rego policies, and YAML tree traversal to infer attribute paths and retrieve source locations. ### Source excerpt We recently released a series of improvements to Snyk IaC, and in this blog post, we're taking a technical dive into a particularly interesting feature -- automatic source code locations for rule violations. ## 10 GitHub Security Best Practices DevFeed: [10 GitHub Security Best Practices]() Original publisher: [Read original article]() Author: Brian Vermeer Published: 2024-02-05T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [MFA](), [passwords]() Tags: [acquisition](), [application-security](), [authentication](), [awareness](), [best-practices](), [cheat-sheet](), [code-security](), [developer](), [devops](), [devrel](), [devsecops](), [github](), [open-source](), [open-source-security](), [security](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [workflows]() ### AI overview A cheat sheet outlining ten GitHub security best practices, including enforcing two-factor authentication to protect repositories, code, and development workflows. ### Source excerpt In this cheat sheet, we will discuss ten best practices you can implement to improve your GitHub security. Download the one-pager and read on for a more extensive explanation of all ten curated actions. ## Snyk highlights AWS re:Invent 2023 DevFeed: [Snyk highlights AWS re:Invent 2023]() Original publisher: [Read original article]() Author: David Lugo Published: 2023-12-14T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Generative AI](), [Securing AI](), [Amazon Web Services](), [ai security](), [code security](), [Application Security](), [Application Development](), [Language models](), [cloud security](), [Infrastructure as code](), [Containers](), [sdlc]() Tags: [acquisition](), [ai](), [ai-code-security](), [ai-coding](), [ai-security](), [ai-tools](), [amazon](), [application-development](), [aspm](), [awareness](), [aws](), [blog](), [cloud](), [cloud-computing](), [code](), [code-security](), [coding](), [container-security](), [containers](), [devops](), [executive](), [generative-ai](), [iac-security](), [interest](), [megawatt](), [related-content](), [sdlc](), [security](), [security-solutions](), [snyk](), [snyk-apprisk](), [snyk-container](), [snyk-iac](), [tool]() ### AI overview This recap covers Snyk's AWS re:Invent 2023 highlights, including AWS partnership achievements, new AWS integrations, generative AI developments, and the use of AI coding assistants. It emphasizes the need for AI security solutions because AI-generated code can increase vulnerabilities. ### Source excerpt In this blog, we recap the most exciting developments from AWS re:Invent 2023, including Snyk's industry-leading progress with generative AI, ASPM, and the importance of AI security. ## Three reasons to invest in an ASPM solution in 2024 DevFeed: [Three reasons to invest in an ASPM solution in 2024]() Original publisher: [Read original article]() Author: Julia Kraut Published: 2023-12-12T12:55:00Z Content type: opinion Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Application Security](), [snyk-apprisk](), [snyk](), [Security](), [snyk-platform](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source]() Tags: [acquisition](), [application-security](), [aspm](), [blog](), [executive](), [pmm](), [sast](), [sca](), [security](), [snyk](), [snyk-apprisk](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform]() ### AI overview This guide presents three reasons to invest in an application security posture management solution: consolidating security vendors, improving application security tool coverage, and managing security and compliance controls. It specifically promotes Snyk AppRisk and its integration with the Snyk platform. ### Source excerpt Learn three compelling reasons to invest in an application security posture management (ASPM) solution like Snyk AppRisk. ## Rego 103: Types of values and rules DevFeed: [Rego 103: Types of values and rules]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt; Becki Lee Published: 2023-11-16T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Open Policy Agent](), [Infrastructure as code](), [Programming]() Tags: [beginner](), [blog](), [blog-post](), [cloud-security](), [code](), [developer](), [devrel](), [enablement](), [iac-security](), [infrastructure-as-code](), [learn](), [opa](), [policy](), [programming](), [rego](), [snyk-cloud](), [snyk-iac](), [types]() ### AI overview This beginner-focused article is the third part of a Rego introduction series. It explains scalar and composite value types, including strings, numbers, booleans, null, arrays, objects, and sets, and introduces set rules, object rules, functions, and iteration for writing policies evaluated by OPA. ### Source excerpt Learn about the different types of Values and Rules you can use to build policies in OPA & Rego. ## Rego 102: Combining queries with AND/OR and custom messages DevFeed: [Rego 102: Combining queries with AND/OR and custom messages]() Original publisher: [Read original article]() Author: Jasper Van der Jeugt; Becki Lee Published: 2023-11-09T06:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Programming](), [Cloud](), [Infrastructure as code](), [JSON](), [YAML]() Tags: [beginner](), [blog](), [blog-post](), [cloud-security](), [code](), [developer](), [devrel](), [enablement](), [guide](), [how-to](), [iac-security](), [opa](), [policy](), [programming](), [rego](), [snyk-cloud](), [snyk-iac]() ### AI overview A beginner-focused guide to intermediate Rego syntax, explaining how to combine queries with AND and OR and introduce custom messages. It describes how OPA evaluates Rego policies against JSON or YAML input documents. ### Source excerpt Learn how to use AND and OR rules and custom messages using OPA and Rego in the second part of our beginner's guide to Rego. ## Rego 101: Introduction to Rego DevFeed: [Rego 101: Introduction to Rego]() Original publisher: [Read original article]() Author: Becki Lee Published: 2023-11-02T05:00:00Z Content type: tutorial Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [rego](), [opa](), [Open Policy Agent](), [Infrastructure as code](), [Security](), [Programming]() Tags: [blog](), [blog-post](), [cloud-security](), [developer](), [devrel](), [enablement](), [how-to](), [iac-security](), [infrastructure-as-code](), [infrastructure-as-code-iac](), [learn](), [opa](), [policy](), [rego](), [security](), [snyk-cloud](), [snyk-iac](), [tutorial]() ### AI overview A beginner-focused introduction to Rego, the declarative policy language used with Open Policy Agent (OPA). It explains policy as code, how OPA evaluates Rego policies, and how these policies can be applied to cloud and infrastructure-as-code resources. ### Source excerpt Learn how to write your first policy as code rules in Rego. This Rego tutorial for beginners covers the basics of Rego syntax and using OPA. ## Snyk Partner Speak video series with HashiCorp DevFeed: [Snyk Partner Speak video series with HashiCorp]() Original publisher: [Read original article]() Author: Sarah Conway Published: 2023-10-04T05:00:00Z Content type: news Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security]() Tags: [application-security](), [automation](), [awareness](), [blog](), [cloud](), [cloud-infrastructure](), [deployment](), [developer](), [devops](), [executive](), [iac-security](), [infrastructure-as-code](), [partnership](), [related-content](), [security](), [series](), [snyk-iac](), [terraform](), [video](), [vulnerability](), [workflows]() ### AI overview Snyk and HashiCorp present a video about integrating security into development and deployment workflows. The partnership applies Snyk scanning and remediation to Terraform Cloud workflows to identify and fix infrastructure-as-code misconfigurations before production. ### Source excerpt The latest Snyk Partner Speak Series video showcases how Snyk and HashiCorp enable development teams to easily build and deploy applications with integrated security at every stage. ## Announcing IaC+ early access: Secure your infrastructure configurations across the SDLC DevFeed: [Announcing IaC+ early access: Secure your infrastructure configurations across the SDLC]() Original publisher: [Read original article]() Author: Lauren Place Published: 2023-10-03T13:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [iac-security](), [snyk-iac](), [Infrastructure as code](), [snyk](), [sdlc](), [Terraform](), [ide](), [ci](), [Command-line interface](), [Monitoring]() Tags: [acquisition](), [blog](), [ci](), [ci-cd](), [cli](), [cloud-security](), [compliance](), [convert-paid](), [devops](), [enablement](), [executive](), [iac](), [iac-security](), [ide](), [monitoring](), [pmm](), [preview](), [sdlc](), [security](), [snyk](), [snyk-iac](), [terraform]() ### AI overview Snyk announces IaC+, an early-access version of Snyk IaC available through Snyk Preview from October 3, 2023. It is designed to help developers find and fix infrastructure misconfigurations across the SDLC, from code to cloud, with improved pre-deployment analysis, broader security and compliance rules, and support for multi-file Terraform analysis. ### Source excerpt We're excited to announce that IaC+ is available in early access via Snyk Preview starting October 3rd, 2023. ## Manage security issues in Jira with Snyk Security in Jira Cloud DevFeed: [Manage security issues in Jira with Snyk Security in Jira Cloud]() Original publisher: [Read original article]() Author: LaToya Muff Published: 2023-08-09T05:00:00Z Content type: article Language: en Sources: [Blog RSS Feed | Snyk]() Topics: [Security](), [snyk](), [atlassian](), [DevSecOps](), [Vulnerabilities](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source]() Tags: [acquisition](), [americas](), [application-security](), [atlassian](), [awareness](), [blog](), [cloud-security](), [devops](), [devsecops](), [executive](), [integration](), [jira](), [pmm](), [related-content](), [security](), [snyk](), [snyk-code](), [snyk-container](), [snyk-iac](), [snyk-open-source](), [snyk-platform](), [snyk-security-intel](), [tech](), [vulnerabilities]() ### AI overview Snyk Security in Jira Cloud integrates Snyk Open Source, Snyk Code, Snyk Container, and Snyk IaC with Jira. It helps development and security teams detect, prioritize, track, and resolve dependency, code, container, and infrastructure-as-code security issues. ### Source excerpt Snyk started gradually rolling out the Jira Security App and has significantly improved the functionality and features available to users. Snyk Security in Jira Cloud has quickly become a breakout leader in security in Jira.