Hey everyone! 👋 I've been deep in the weeds with Snyk for about a year now across several projects, and something that kept coming up in our security syncs was the question: "Are we actually *fixing* the vulnerabilities we find, or just staring at the reports?"
We had the Snyk data, but it was scattered across projects and teams. So, over the last couple of weekends, I built a simple internal dashboard to visualize fix rates, and it's already sparked some great conversations.
Here's the basic idea of what we're tracking now:
* **Team-level fix rate %:** Calculated as (vulnerabilities fixed in last 30 days / total opened in that period). This highlights which teams are prioritizing remediation.
* **Average time to fix (by severity):** We pull this from Snyk's project history. Seeing that criticals get fixed in 2 days while highs linger for 30+ was a real eye-opener.
* **Top recurring vulnerability types:** A simple bar chart showing if we're repeatedly getting the same kind of issue (looking at you, `lodash` upgrades).
I built it by pulling data from Snyk's APIs into a small database (I used PostgreSQL) and then used a straightforward tool (Metabase, in our case) to create the charts. The goal wasn't to create a blame tool, but a visibility tool. It's helped our security champions show their own teams tangible progress and has made cross-team discussions way more data-driven.
Has anyone else tried something similar? I'm curious about:
* What other metrics did you find valuable?
* Did you run into any pitfalls with the API data?
* Did tracking this formally change your team's behavior?
Would love to swap notes and maybe share some dashboard configs if folks are interested!
~jennam
Less hype, more data.