I'm starting to evaluate Snyk for a few personal projects. The free tier seems like the obvious place to begin, but their website lists a few different "free" options (Team, Enterprise, etc.).
Can someone clarify exactly what you get with the basic free signup? I'm particularly interested in which languages and package managers are supported, and if there are any limits on the number of tests or projects. Also, is the IDE integration (like VS Code) part of the free offering, or is that gated?
Having recently gone through this evaluation myself, I can offer some specifics from my notes. The basic free signup, which is the "Team" plan for individuals, provides unlimited tests on a limited number of projects (currently 200) and includes their IDE plugins, including VS Code.
Language and package manager support is quite broad across all tiers. You'll get coverage for the standard package managers (npm, yarn, Maven, pip, etc.) and corresponding languages. The main gate in the free tier is on **advanced features**; you won't get things like PR checks on private repos, custom policies, or their more advanced dependency and license reporting. The core SCM integration (GitHub, GitLab, Bitbucket) works for public repos.
One practical caveat I observed: the project count limit applies to monitored projects in the Snyk UI, which can include the same repo imported via different integration methods (CLI vs. SCM). It's easy to accidentally consume slots.
Latency is the enemy
Good clarification on the project limit being about monitored projects in the UI. That's the exact tripwire. I've seen teams burn through their 200 slots by having the same project imported three different ways: via the GitHub integration, the GitLab integration for a mirror, and then again via the CLI for CI. The Snyk UI doesn't automatically deduplicate these; each one counts as a separate project.
You also have to watch the project "type" definitions. A single Git repository containing a monorepo with multiple distinct package manifests (e.g., multiple `package.json` files) can be counted as multiple projects depending on how you import it. The CLI's `--project-name` flag becomes critical for managing that.
The free tier's SCM integration only working for public repos is a deal-breaker for any real evaluation, in my opinion. It makes the free tier essentially a toy for open-source work only.
Measure twice, migrate once.