See Snyk Advisor.

Asset (Snyk AppRisk)

A Snyk AppRisk asset is an identifiable entity that is part of an application, and relevant for security and developers. Snyk is generally focused on the development stages of application software, secures repository assets containing software package assets, and builds artifacts like container image assets.

Application (Snyk AppRisk)

An application is software that serves a business purpose and consists of assets that form the app. Organizations often define the scope of an application differently.

Application Graph

Represents the mapping of security issues, application assets, relationships between assets, and all relevant contextual information.


Base image

The parent image used to construct a container image, usually defined in the FROM directive in a Dockerfile. Base images themselves can be constructed from other base images.


See Snyk Broker.

Build System

A system that takes the source code and builds the deployable application (such as a container).

Business context

Information related to the organization's objectives, priorities, and regulatory requirements, such as criticality of the application to the business, compliance standards, data sensitivity, and potential impact on revenue or reputation.



Continuous integration (CI), continuous delivery (CD), and continuous deployment (CD) together comprise a Software Development Lifecycle (SDLC) model, guiding developers to automate the development and delivery of small, frequent changes. This ensures all team members have access to the latest codebase and can ensure the compatibility of committed code during development. See Snyk CI/CD for details of Snyk CI/CD integrations.

Class (Snyk AppRisk)

A way to assign business context to assets and categorize an asset based on the business criticality. Assets can be assigned Classes A, B, C, or D, where Class A (assets that are business critical, deal with sensitive data, are subject to compliance, and so on) is the most important, and Class D (test apps, sandbox environments, and so on) the least important. Assets are assigned Class C by default. A class can be used in policies as well as defined in a policy.


Command Line Interface. See Snyk CLI.

Cloud Native Application Security

Implementing security throughout the CI/CD pipeline, automating security embedding in microservices, and maximizing repetition to reduce the introduction of vulnerabilities. Snyk provides a comprehensive CNAS platform. See the article Cloud-native security guide for building secure applications.

Code assets (Snyk AppRisk)

A hierarchical list of all assets retrieved from the scanned repositories.


Containers allow you to package applications and their dependencies together to be deployed as a single runnable unit. A container is an abstraction provided by the operating system kernel that allows a process to be isolated from other processes running on the system. See also Snyk Container.

Container engine

For users, an application that takes a container image and turns it into a running container. Container engines typically interface with container registries and run containers. Examples of container engines include Docker, CRI-O, and LXC.

Container image

One or more files that, when instantiated by a container engine or runtime, provide a running container. Images are the packaging and distribution format for containers.

Container registry

A server that provides a mechanism to store and retrieve container images.

Controls (Snyk AppRisk)

The security controls associated with the asset. Navigate to the Snyk AppRisk Controls section to see all available statuses for security controls.

Coverage (Snyk AppRisk)

An assessment of whether applicable assets are scanned and tested by security tools (like Snyk Open Source, for instance), as it relates to an application security program. A type of policy that allows you to specify what controls should be applied and, optionally, how often it needs to be run.

Coverage gap (Snyk AppRisk)

An assessment of all assets that fall "out of policy" and do not satisfy the coverage criteria you have specified, due to infrequent scanning or no scanning at all.


Common Vulnerabilities and Exposures. A widely-used identifier for a well-known vulnerability.


Common Vulnerability Scoring System. An industry standard to assess the severity of vulnerabilities, using a score of 0 (lowest) to 10 (highest). Snyk uses CVSS.


Common Weakness Enumeration. An online glossary that categorizes software and hardware weaknesses into different types, for example, CWE-20: Input Validation.



Dynamic Application Security Testing. An application that you can point at a site or service; it then typically profiles the site or service, then examines the output and behavior to uncover security vulnerabilities. See also SAST.


When your application uses another package, this other package becomes a dependency in your own software.

  • A direct dependency is a package you include in your own Project.

  • An indirect dependency (also known as a deep, chained, or transitive dependency), is a package that is used by one of your direct dependencies.

Dependency tree

Also known as Dependency path. A hierarchical graph showing the dependencies of a software application. This includes both direct and indirect dependencies and thus may be many levels deep.

Development context

Information and requirements surrounding the development of applications within an organization, such as ownership, development tools, environments, teams, workflows, and processes.


A set of cultural philosophies, practices, and tools that combines software development and IT operations to shorten the systems development lifecycle.


The integration of security into emerging agile IT and DevOps development as seamlessly and as transparently as possible.


A text file format used to build container images using Docker. The Dockerfile contains all the commands needed to construct the final image, including specifying the parent base image.



Can refer to a cloud environment, a Project attribute, or an interface for working with Snyk, such as the Snyk CLI, Web UI, or an IDE.


A demonstration of how a vulnerability can be taken advantage of. When an exploit is widely published, it is commonly referred to as an exploit "in the wild". See View exploits.

Exploit Maturity

A measure of how practical an exploit for a vulnerability is, based on whether the exploit is in the wild, and how "helpful" the exploit is to attackers.


Fixable / Partially fixable

A measure of whether a vulnerability can be fixed by Sny by applying a patch, upgrade, or pin. See Vulnerability fix types.

Fix PR

A pull request with an automatic fix for discovered vulnerabilities that Snyk can offer the user. See Automated fix PRs.



A distributed version control system for tracking changes in source code during software development.



Infrastructure as Code. See Snyk Infrastructure as Code.


Interactive Application Security Testing. This approach tests for vulnerabilities while running the application. See DAST and SAST.


Integrated Development Environment. An application that has facilities for software development, typically with a source code editor, build automation tools, and a debugger.


The stored instance of a container that holds a set of software needed to run an application.

Image layer

Container images typically consist of several different file system layers, which are combined together at runtime into a single file system.


Third-party products, applications, and platforms that Snyk works with, for example, SCM systems such as GitHub. See Integrate with Snyk.


A license problem, vulnerability, or misconfiguration identified and listed by Snyk. See Find and manage priority issues.

Issue (Snyk AppRisk)

An issue is a security problem identified by a Snyk security product when testing an asset, that AppSec teams need to remediate.

Issues prioritization (Snyk AppRisk)

Provides a centralized view of all the issues identified by Snyk with additional asset context. This empowers AppSec teams to better triage and remediate issues in Snyk.

Issue context (Snyk AppRisk)

Information surrounding a particular security issue that serves as objective risk factors such as issue severity level, availability of a fix, exploit maturity.



A specific type of package.

License policy

A set of criteria for evaluating open-source license issues. License policies enable you to set the severity level and define legal instructions for each license. See License policies.



A file containing metadata about other files in a package.


The snyk monitor command tests a Project and uploads the results to Snyk. See the CLI help for Monitor.



Open Container Initiative. An independent body set up to facilitate collaboration on standards for containers, to ensure they are interoperable between vendor solutions.


An Organization in Snyk is a way to collect and organize your Projects. Members of Organizations have access to these Projects. See Manage Groups and Organizations.

Origin or source

The identifier for the ecosystem that a Target exists in. Snyk can scan Projects from multiple integrations, including CLI, API, GitHub, Kubernetes, and others. See Snyk Projects.



A group of files and additional metadata about those files, used by package managers.

Package assets (Snyk AppRisk)

Package assets are created when you scan the dependencies of a Project through package management systems or by using the Snyk CLI. This enables Snyk AppRisk to identify and analyze the security vulnerabilities of the packages used within a Project, offering insights into possible risk exposures and providing recommendations for mitigation.

Package manager

A set of tools that automate and manage packages of bundled files, and are usually specific to a language. For example, npm.

Package registry

A software package hosting service that allows customers to host packages and code in one place.


A fix type: define and "pin" a specific version of an indirect dependency, to avoid a direct dependency pulling in a vulnerable version.


See license policy, security policy, and .snyk policy.

Policy (Snyk AppRisk)

A way to automate actions in certain conditions, like classifying and tagging assets with business context. You can also use a policy to configure actions like sending a message or setting the coverage gap control using a Policy builder UI.


Pull Request. Allows a user to exchange changes made to source code and collaborate with others on the same branch.

PR Checks

Use Snyk PR Checks to prevent new security issues from entering your codebase by automatically scanning code changes in real-time as soon as you submit a pull request (PR) in your source code manager (SCM). See Run PR Checks.

Priority Score

Snyk scores issues, including vulnerabilities and licenses for Open Source, to help prioritize the treatment of each one. Scores are based on multiple factors including the CVSS score and range from 0 (low) to 1000 (high). See Priority Score.


An external item scanned by Snyk with configuration to define how to run that scan. Projects appear on the Projects menu on the Snyk dashboard. See also Target. For details, see Snyk Projects.



Whether an application contains code that will hit a vulnerable code path during execution. See Reachable vulnerabilities.


See Container registry or Package registry.


A storage area that contains all elements necessary for the distribution of an application.

Repository assets (Snyk AppRisk)

A repository asset is created by discovering the repositories directly in the SCM, when such integration is configured. Alternatively, a repository asset can be created by scanning a repository, (by Snyk or third-party tools) as long as the scanned code is identified with a specific repository.


A cloud infrastructure entity such as an AWS S3 bucket, Identity and Access Management (IAM) role, or Virtual Private Cloud (VPC) flow log.

Risk-based prioritization (Snyk AppRisk)

Assess the risk for each app based on the application context and conduct best-in-class security analysis. Provide fix guidance to direct developer remediation efforts towards the most critical business issues.

Risk score

A value assigned to an issue, ranging from 0 to 1,000, representing the risk imposed on your environment.


A security policy that checks cloud infrastructure and infrastructure as code (IaC) for misconfigurations that can lead to security problems, or a security rule used by Snyk Code when scanning your source code for vulnerabilities. For more information, see Snyk Code security rules and IaC custom rules.

Runtime context (Snyk AppRisk)

Information on where and how an application is running.



Static Analysis Results Interchange Format. A standard, JSON-based format for the output of static analysis tools.


Static Application Security Testing. A method to secure software by reviewing the source code of your proprietary software and identifying sources of vulnerabilities. See also DAST.


Software Bill Of Materials. A list of components in a piece of software.


Software Composition Analysis. A technology that is used to identify open-source and third-party components in use in an application, including their known security vulnerabilities, and typically adversarial license restrictions. See also Static Code Analysis.

Scanned artifacts (Snyk AppRisk)

A scanned artifact in Snyk AppRisk is an entity detected by Snyk that cannot be identified as a repository asset because it does not include identifying information, such as a Git remote URL.