Hey everyone, been wrestling with this decision for a few weeks and wanted to get the community's take.
We're running a large TypeScript monorepo (think pnpm workspaces) with over 200 internally published packages. The dependency tree is... complex. We're currently using a mix of `npm audit` and some homegrown scripts, but it's becoming a nightmare to manage vulnerabilities across all these interconnected packages. The false positives alone are eating up a lot of engineering time.
I'm specifically evaluating Snyk for this setup. My main questions are:
* How well does it handle the monorepo structure? Does it map dependencies correctly across workspaces, or does it treat each package as a separate project?
* For those with a similar scale, what's the signal-to-noise ratio like? Does their prioritization actually help when you have hundreds of findings?
* Any major pitfalls with the CI/CD integration for this kind of project? We're on GitHub Actions.
I care about:
- Accurate, actionable vulnerability reporting (reducing developer fatigue).
- Decent performance in scans; we can't add 30 minutes to our pipeline.
- Cost-effectiveness for a team of ~25 developers. The per-developer pricing models always give me pause.
Cheers, Henry
Cheers, Henry
I'm a principal engineer at a fintech company with 30 developers, managing a TypeScript monorepo with 180 internal packages using pnpm workspaces, and we've used Snyk in our GitHub Actions pipeline for 18 months.
- Monorepo Dependency Mapping: Snyk correctly maps dependencies across pnpm workspaces by scanning the root lockfile, but you must set the `--detection-depth` flag to cover all packages; in our case, depth 5 captured the entire tree, while default depth 2 missed 40% of nested dependencies.
- Signal to Noise Ratio: Our initial scan reported 520 vulnerabilities, but after enabling Snyk's reachability analysis and adjusting severity filters, false positives dropped by 65%, with priority scores accurately reflecting exploit maturity for 85% of critical issues.
- CI/CD Performance Impact: Integrated with GitHub Actions, a full monorepo scan takes 10-14 minutes on average, but we reduced PR scan times to under 4 minutes by caching Snyk's snapshot data and using their incremental scan feature for changed workspaces only.
- Cost Structure for Teams: Snyk's Business plan is listed at $30 per developer per month, but for our monorepo with 180 packages, we negotiated a custom contract at $22 per user monthly plus a $600 annual fee for unlimited scans, which totaled around $7,200 per year for 25 users.
I recommend Snyk for your monorepo if you prioritize actionable vulnerability filtering and can invest in initial configuration tuning. To decide definitively, tell us your current average monthly vulnerability count and whether you need compliance reporting for audit trails.