# Manage code vulnerabilities

## Prerequisites for managing code vulnerabilities in Snyk Web UI

Before managing vulnerabilities with Snyk Code, ensure the following:

* You have completed the steps in [Getting started](https://docs.snyk.io/discover-snyk/getting-started).
* Your repositories contain code in a [supported language and platform](https://docs.snyk.io/supported-languages/supported-languages-package-managers-and-frameworks).
* You have [configured Snyk Code](https://docs.snyk.io/scan-with-snyk/snyk-code/configure-snyk-code).

## How Project testing for Snyk Code works

Each time a Project is tested, Snyk Code takes a snapshot of the repository in its current state and analyzes it to find vulnerabilities. All the files that contain source code that Snyk Code can analyze are aggregated in the Code analysis.

When you import a repository, Snyk creates a Target folder that contains different Snyk Projects based on the file types present in the repository. The name of the Target folder includes the repository name, the integrated Git repository account name and its icon, and the number of Snyk Projects created for the repository.

Snyk Code creates a single Project for all the imported files from a repository. This aggregates vulnerabilities detected in the repository code into one Project, presenting the data flow of a vulnerability issue across multiple files.

Automate importing multiple repositories using the API endpoint [Import targets](https://docs.snyk.io/snyk-api/reference/import-projects-v1#org-orgid-integrations-integrationid-import).

## Code testing from import to retest

The following provides an overview of the testing process in Snyk Code based on the testing phases.

<table><thead><tr><th width="250">Phase</th><th>Description</th></tr></thead><tbody><tr><td><a href="import-project-with-snyk-code">Import repository</a></td><td>Performed when you import a repository.</td></tr><tr><td><a href="../../snyk-platform-administration/snyk-projects/view-and-edit-project-settings">Schedule recurring tests</a></td><td>Automatically performed when you schedule them.</td></tr><tr><td><a href="#retesting-code-repository">On demand testing (retesting code repository)</a></td><td>Performed on demand when you select <strong>Retest now</strong>.</td></tr></tbody></table>

### Retesting code repository

If you want to check for the most recent vulnerabilities in your repository, you can do a manual test by selecting the **Retest now** option. This will trigger Snyk Code to take a fresh snapshot of your repository and analyze its source code files. The results will then be displayed on the Code Analysis page. Take into consideration that Snyk counts a manual test as a new test. See [What counts as a test?](https://docs.snyk.io/snyk-data-and-governance/what-counts-as-a-test)

You can also use the **Retest now** option to apply the exclusion rules of the `.snyk` file to an imported repository. See [Exclude directories and files from Project import](https://docs.snyk.io/scan-with-snyk/import-project-repository/exclude-directories-and-files-from-project-import).

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-46bcbd3832fdc8ff3156fa890104c936d15942af%2Fprojects-code-analysis-retest.png?alt=media" alt="Retesting a repository."><figcaption><p>Retesting repository</p></figcaption></figure>

## Project filters

The Projects page on Snyk Web UI has a filter pane that categorizes Snyk Projects and shows the number of matching Projects for each criterion. See [Project information](https://docs.snyk.io/snyk-platform-administration/snyk-projects/project-information).

The **Grouping by File or Vulnerability Type** feature offers the following additional options:

* **Group by File**: This option helps identify specific files that contain multiple vulnerabilities, enabling you to focus on problematic files that may need more rigorous review or refactoring.
* **Group by Vulnerability Type**: This option categorizes vulnerabilities by their type, such as SQL Injection or Cross-Site Scripting (XSS), assisting in addressing the most prevalent types of vulnerabilities within your codebase.

## Vulnerability issues

You can change the display of the issues on the Code analysis page using the following options:

### Group by **File** or **Vulnerability Type**

Identify problematic files with multiple issues or address frequent vulnerability types. Use these filtering options to determine where vulnerabilities are likely to cluster together.

### Sort by Severity level

Sort vulnerability issues by displaying those with the highest severity levels first, followed by those with lower severity levels.

### Filter vulnerabilities by criteria

Filter discovered vulnerability issues according to different criteria shown in the following table.

<table><thead><tr><th width="232">Vulnerability issue filter</th><th>Description</th></tr></thead><tbody><tr><td><a href="../../manage-risk/prioritize-issues-for-fixing/severity-levels">Severity level</a></td><td>Show issues with a certain severity level. Snyk Code uses only <strong>High</strong>, <strong>Medium</strong>, and <strong>Low</strong> severity levels, without <strong>Critical</strong>.</td></tr><tr><td><a href="../../../manage-risk/prioritize-issues-for-fixing/priority-score#calculation-of-priority-score">Priority score</a></td><td>Show issues in a certain priority score range.</td></tr><tr><td>Status</td><td>Show <strong>Open</strong> issues or issues that were <strong>Ignored</strong>.</td></tr><tr><td><a href="../../supported-languages/supported-languages-package-managers-and-frameworks">Languages</a></td><td>Show issues that were discovered in code files that were written in a specific language. Only programming languages discovered in the analyzed repository are displayed in the Filter pane.</td></tr><tr><td><a href="snyk-code-security-rules">Vulnerability types</a></td><td>Show issues with a certain Vulnerability Type. See <a href="snyk-code-security-rules">Snyk Code security rules</a>.</td></tr></tbody></table>

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-cdce25dd1f34cb6e5df4bcc9286c337bcba8cfaf%2Fprojects-vulnerability-filters.png?alt=media" alt="Overview of vulnerability issue filtering, sorting, and grouping."><figcaption><p>Vulnerability issue filtering, sorting, and grouping</p></figcaption></figure>

## **Scan for code vulnerabilities**

To scan your repositories and manage code vulnerabilities, you can check the following actions.

### View vulnerabilities in a repository

1. Log in to the Snyk Web UI and select your [Group and Organization](https://docs.snyk.io/snyk-platform-administration/groups-and-organizations).
2. Navigate to the **Projects** and select the Target folder containing your repository's Projects.
3. Open **Code analysis** Project to see all vulnerability issues detected by Snyk Code.

To understand the results, see [Breakdown of Code analysis](https://docs.snyk.io/scan-with-snyk/snyk-code/manage-code-vulnerabilities/breakdown-of-code-analysis).

### Import additional repositories

If you have existing Projects in your Snyk account, you can add additional repositories for Snyk to test. See [Import repository to Snyk](https://docs.snyk.io/scan-with-snyk/snyk-code/import-project-with-snyk-code).

### Remove repositories from testing

You can remove the Code analysis Project or delete imported repositories if you no longer need to test them for vulnerabilities. See [Remove imported repository](https://docs.snyk.io/scan-with-snyk/import-project-repository/remove-imported-repository-from-a-project).

### Exclude directories and files

To exclude specific files and directories from being imported by Snyk Code, you need to create a `.snyk` YAML policy file in your repository. See [Exclude directories and files from Project import](https://docs.snyk.io/scan-with-snyk/import-project-repository/exclude-directories-and-files-from-project-import).

You can specify directories to exclude from the import process using the Exclude dialog box when you import repositories through Git repository. However, this feature is only supported for open-source dependency scans (SCA).

### Open repository external link

To access the repository on the integrated Git repository platform, navigate to the Code analysis Project and select the name of the repository.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-26cf1c28eceb062ea7b20a3ee3c2ad6c0140b3b0%2Fprojects-open-github-repository.png?alt=media" alt="Overview of the external repository link."><figcaption><p>External repository link</p></figcaption></figure>

### View Project history

The result history is shown on the **History** page of the **Code Analysis** Project. This page displays the snapshots taken when a test was performed. You can review Snyk Code test results for all the testing phases. See [Code testing from import to retest](#code-testing-from-import-to-retest).

On the **History** page, only two distinct snapshots are displayed. A snapshot is deemed unique if either the repository or its associated vulnerability findings have altered since the last assessment, resulting in a snapshot that showcases these changes. If there have been no changes in the repository or the vulnerability results since the last test, the new snapshot will replicate the prior one. Consequently, this will be listed as an additional test run on the **History** page. This means while the page may present multiple test entries, only up to two will feature distinct results.

To view Project history:

1. Log in to the Snyk Web UI and select your [Group and Organization](https://docs.snyk.io/snyk-platform-administration/groups-and-organizations).
2. Navigate to the **Projects** and select the Target folder containing your repository's Projects.
3. Open **Code analysis** Project and navigate to **History**.
4. Select a test from the list to view the Project historical snapshot.
5. (Optional) Select **View most recent snapshot**. This option is not available when the most recent snapshot is open.

<figure><img src="https://2533899886-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MdwVZ6HOZriajCf5nXH%2Fuploads%2Fgit-blob-a40bb45be170f4cbe272d10fdf9eb761fc95d7b0%2Fprojects-code-analysis-history.png?alt=media" alt="Overview of Snyk Code Project history"><figcaption><p>Snyk Code Project history</p></figcaption></figure>

### Manage Project settings

Manage Project settings as follows:

* Schedule recurring tests: [Configure Test & Automated Pull Request Frequency](https://docs.snyk.io/snyk-platform-administration/snyk-projects#test-frequency-settings).
* Retrieve the Project ID: [Retrieve the unique identifier for the Project](https://docs.snyk.io/snyk-platform-administration/snyk-projects#project).
* Deactivate Project: [Temporarily disable the Project without deleting any data](https://docs.snyk.io/snyk-platform-administration/snyk-projects#delete-activate-or-deactivate).
* Delete the Project: [Permanently remove the Project and all associated data](https://docs.snyk.io/snyk-platform-administration/snyk-projects#delete-activate-or-deactivate).

## Tracking vulnerabilities across code changes

Snyk Code goes beyond simple static analysis by tracking vulnerabilities across multiple scans, even as your codebase evolves. This ensures consistent and accurate vulnerability management, regardless of code refactoring, file renaming, or positional changes.\
\
Consider a scenario where a vulnerability exists in `file1.js` on line 45. After a code refactor, the vulnerability persists but is now located in a different file and line. To effectively address such scenarios, Snyk Code employs a sophisticated issue-tracking system. To tracks vulnerabilities\
Snyk Code performs the following:

1. Fingerprint matching:
   * Generates a min-hash of the code's syntax tree for each vulnerability.
   * Calculates nearest neighbors from these hashes to identify similar vulnerabilities across scans.
2. File position comparison:
   * Analyzes file paths and line numbers to account for code movement.
   * Calculates similarity based on directory, filename, and line/column changes.

### Final confidence scoring

Snyk Code combines the results of fingerprint matching, file position comparison, and historical weighting to generate a final confidence score. This score indicates the likelihood that two vulnerabilities from different scans are the same.

For example, if a vulnerability in `utils/auth_utils.js` is moved to `utils/auth_helpers.js` and the line number changes. Snyk Code's algorithms would perform the following:

* Identify a new vulnerability in `utils/auth_helpers.js` and generate a fingerprint from its AST.
* Compare the new vulnerability's fingerprint with issues found in the previous scan.
* Identify a high fingerprint similarity despite minor AST changes.
* Recognize the high file path similarity due to the shared directory and similar file names.
* Account for the line number change while maintaining a high overall confidence score.
* Match the new vulnerability with the vulnerability with highest confidence score from the previous scan.

## What's next?

* [See the breakdown of Code analysis](https://docs.snyk.io/scan-with-snyk/snyk-code/manage-code-vulnerabilities/breakdown-of-code-analysis)
* [Fix code vulnerabilities automatically](https://docs.snyk.io/scan-with-snyk/snyk-code/manage-code-vulnerabilities/fix-code-vulnerabilities-automatically)
* [See Snyk Code security rules](https://docs.snyk.io/scan-with-snyk/snyk-code/snyk-code-security-rules)