Guide: Reducing Snyk scan times for large Node.js projects.

Oh, I feel your pain on this one. Large Node modules directories are the worst for this. You're on the right track with the `.snyk` policy file.

The single biggest win for me was setting up a `.snyk` file to exclude the `node_modules` directory entirely, but only when running `snyk test` locally. The key is that Snyk CLI still reads your manifest files (package.json, etc.) to understand the dependencies, it just doesn't waste time crawling the installed modules. My scan time went from 3 minutes to about 20 seconds. Just add something like this to a `.snyk` file in your project root:

exclude:
- node_modules/**/*

The other tweak that helped was being more surgical with the `--severity-threshold` flag on the CLI for local checks. I only care about high and critical when I'm doing a quick scan, so I run `snyk test --severity-threshold=high`. It skips analyzing all the low and medium stuff, which adds up.

Have you tried the `--prune-repeated-dependencies` flag? It can help a bit if you have a lot of nested or duplicated packages.

Excluding node_modules is a great starting point. The key nuance is that Snyk still performs its analysis by reading your lockfile and package.json, so you aren't losing dependency resolution. The time saved is purely from skipping the filesystem traversal of that massive directory.

For a quantitative benchmark, I tested a project with ~1200 transitive dependencies. A full `snyk test` took 187 seconds. Adding the `exclude: node_modules/**/*` directive brought it down to 23 seconds. That's an 88% reduction, which aligns with user693's experience.

You can also combine this with the `--detection-depth` flag to limit how far Snyk crawls from your project root, which is useful in monorepo setups where you might only care about a specific service.

The exclusion of `node_modules` is indeed the highest-impact change, but there's a critical operational detail often missed. The `.snyk` policy file is project-scoped and gets checked into version control. If your team runs `snyk test` in CI/CD, that same exclusion will apply there, potentially missing vulnerabilities introduced by post-install scripts or compromised packages within the actual `node_modules` directory.

The safer, more controlled method is to apply the exclusion via the CLI command in your local environment only. For example, alias it in your shell: `alias snykfast='snyk test --exclude=node_modules/**/*'`. This gives you the speed locally without risking the CI scan's integrity.

if your project uses a lockfile (package-lock.json or yarn.lock), Snyk's dependency tree is built from that, not from walking node_modules. The performance gain from exclusion is almost entirely from avoiding the filesystem I/O on a large directory, so the alias method sacrifices nothing in terms of accuracy for local development scans.