Guy Podjarny, Snyk | Node Summit 2017
summary
Snyk scans npm dependency trees, curates a vulnerability database fed by automated detection and security research, and generates fixes automatically — including single-click open a fixed PR and built patches for packages that can’t be upgraded. Example claim: a 19-line Node.js function pulls two packages that transitively bring in 19 packages and 190,000 lines of code, shifting risk into third-party modules. Serverless adoption moves attackers up into application code, so the tool focuses on developer workflow integration and continuous monitoring.
AI-written summary · about
chapters (4)
related talks
14mStranger Danger: Tracking Vulnerabilities in Your Third Party Code
24mStrangerDanger: Finding Security Vulnerabilities Before They Find You!
30mDevSecOps: How to Level Up IT Security Expertise in Your Organization
47mNode.js Security: Breaking The Loop
47mBlack Clouds and Silver Linings in Node.js Security
40mSecuring your dependencies
27mPanel: Building A Secure Ecosystem for Node.js
42mSecuring Your Software Supply Chain