Snyk CLI for Snyk Secrets

How to use the Snyk CLI to scan your source code for hardcoded secrets

The Snyk Command Line Interface (CLI) enables you to bring the functionality of Snyk Secrets into your development workflow. Using the Snyk CLI, you can scan your source code locally, in a pre-commit hook, or in your CI/CD pipeline to find hardcoded secrets such as API keys, passwords, and tokens.

Prerequisites for using the Snyk CLI with Snyk Secrets

Before using the Snyk CLI to scan for secrets, verify you have the following prerequisites:

• A Snyk account.

• The Secrets feature enabled for your Snyk Organization. If you receive a SNYK-CLI-0016 error, contact your Snyk account manager.

• The Snyk CLI installed and authenticated.

  • For instructions, visit Install or update the Snyk CLI and Authenticate the Snyk CLI.

  • Snyk recommends using the latest version of the CLI.

Using the Snyk CLI for secrets scans

To scan your code for hardcoded secrets using the Snyk CLI, use the snyk secrets test command. For more information, see Secrets scanning in the Snyk CLI.

That page also explains how to do the following:

• Ignore findings that are placeholders, revoked keys, or won't fix scenarios.

• Review ignored secrets to audit your codebase.

• Exclude files and directories from a scan using the .snyk file or the --exclude option.

• Scan with a pre-commit hook to catch secrets before they reach a commit.