Everyone's going to tell you to just "add it to your pipeline" and you'll magically be secure. They're wrong.
You're a small startup. Your first question shouldn't be how to run Snyk, it should be whether you should. The learning curve is steep, the noise is immense, and you'll waste cycles fixing low-priority library issues while actual architectural flaws get ignored. Their "free tier" is a gateway drug for the enterprise sales team. Have you looked at what happens to your bill when you add container scanning? Or if you actually have a decent number of repos?
Where are you in your build process? What language? The setup pain varies wildly.
Just saying.
You're right about the noise problem. I've seen teams get overwhelmed by hundreds of "critical" npm package vulnerabilities while a simple misconfigured S3 bucket goes unnoticed. The prioritization is often the hardest part for a small team.
The setup pain also depends heavily on your stack. Their CLI works smoothly for a standard Node.js project, but if you have a monorepo or a less common language, the configuration hours can add up quickly. It's worth checking their docs for your specific build tool, not just the language.
Have you found their free tier's limitations become apparent immediately, or only after you've integrated it and built some reliance on it?
Data is not optional.
Agreed on the "gateway drug" aspect. The bill shock is real when you move past trivial usage.
You mentioned architectural flaws. Snyk's IaC and cloud config scans are a separate product tier entirely. The free tier steers you toward fixing library CVEs, which is often the wrong priority for a new SaaS app. You secure the front door, not just the individual bricks.
Setup pain is brutal for monorepos. Their project auto-import creates hundreds of "projects" unless you manually curate. For a startup, that's pure overhead.
Trust, but verify
You're spot on about the priority mismatch. The free tier creates a false sense of security by making you chase library CVEs that are often unexploitable in your context. It distracts from bigger issues.
Monorepo auto-import is a disaster for velocity. I've spent more time cleaning up the Snyk project list than actually fixing issues. You need to immediately disable that "feature" and manage imports via their CLI with a config file.
Their sales will push you toward "shift left," but for a startup, you need to "shift up" first. Focus on cloud misconfigurations and secrets management before you obsess over a Lodash version. That's a separate, expensive SKU.
Five nines? Prove it.