Rolled out Snyk to 200 developers - what broke and what we learned

We just finished rolling out Snyk across all our dev teams. The goal was to catch vulnerabilities in our containers and IaC (mostly Terraform).

The main thing that broke? Our CI/CD pipelines. 😅 Snyk scans added 4-5 minutes per pipeline run. Some teams had their builds timing out because they were already near the limit. We also got flooded with issues in old Terraform modules that we're not even actively using.

Biggest lesson: you can't just turn it on for everyone at once. We should have started with a pilot group, tuned the rules to ignore certain low-severity issues in legacy code, and worked on the timeouts first. Also, the cost for 200 seats is... significant. We're still figuring out if the value matches.