Skip to content
NutsNews chestnut logoNutsNews Wiki

Technical guide · Overview

Page status: Active

Snyk Security Scan

NutsNews uses Snyk as an extra dependency scanner alongside Dependabot and CodeQL.

Visual overview

Primary diagram

System map

NutsNews uses Snyk as an extra dependency scanner alongside Dependabot and CodeQL.

Render the repository-owned system map when you need it.

Diagram is not rendered yet.

View as text
Snyk Security Scan

NutsNews uses Snyk as an extra dependency scanner alongside Dependabot and CodeQL.

flowchart TB
  accTitle: Snyk Security Scan
  accDescr {
    NutsNews uses Snyk as an extra dependency scanner alongside Dependabot and CodeQL.
  }
  A["Snyk Security Scan"] --> B["SNYK_SECURITY_SCAN.md"]
  B --> C["Auto-generated placeholder diagram"]

Snyk Security Scan

Fullscreen diagram view.

Snyk Security Scan

Section titled “Snyk Security Scan”

NutsNews uses Snyk as an extra dependency scanner alongside Dependabot and CodeQL.

What it checks

Section titled “What it checks”

The workflow scans both npm projects:

  • web/ — the Next.js app, API routes, admin pages, contact form, and UI dependencies.
  • Worker dependency scans now live in ramideltoro/nutsnews-worker.

It runs snyk test with a high severity threshold, so high and critical dependency issues fail the workflow. Lower severity issues still appear in Snyk output but do not block normal development.

On pushes to main, it also runs snyk monitor so the projects appear in the Snyk dashboard for ongoing monitoring.

Required GitHub secret

Section titled “Required GitHub secret”

Create this repository secret:

SNYK_TOKEN

Get it from Snyk after logging in:

Snyk → Account settings → Auth Token

Then add it in GitHub:

GitHub repo → Settings → Secrets and variables → Actions → New repository secret

When it runs

Section titled “When it runs”
  • Pushes to main
  • Pull requests into main
  • Weekly scheduled scan
  • Manual workflow dispatch from the Actions tab

Local commands

Section titled “Local commands”

From the web app:

Terminal window
cd web
SNYK_TOKEN="your_token" npx snyk test --file=package.json --package-manager=npm --severity-threshold=high --project-name=nutsnews-web

From the worker:

Terminal window
cd ../nutsnews-worker/worker
SNYK_TOKEN="your_token" npx snyk test --file=package.json --package-manager=npm --severity-threshold=high --project-name=nutsnews-worker

Why this is useful for NutsNews

Section titled “Why this is useful for NutsNews”

NutsNews has public API routes, a contact form, admin routes, Cloudflare Workers, and several environment secrets. Snyk provides another layer of dependency risk visibility, especially around vulnerable npm packages and remediation advice.