Just wrapped up a 6-month trial of Snyk for our production Node/React stack. Overall, it's solid for shift-left, but real-world use surfaces some quirks.
**What works well:**
* The GitHub PR integration is fantastic – catches deps *before* they merge. Big win.
* The container scanning is fast and the CLI is easy to bolt into our CI.
* The license compliance dashboard saved us from a bad lib choice last month.
**What's frustrating:**
* The **noise level**. So many low-severity vulns in old devDependencies that we’ll never fix. Tuning it feels like a part-time job.
* The pricing model feels opaque. Our bill jumped when we added a few more repos – not super scalable for fast-growing teams.
* The UI can be slow when loading results for large projects.
I'm sticking with it for now, mainly for the container scanning and the peace of mind on licenses. But I'm curious…
Has anyone else found a good way to manage the alert fatigue? Or compared it to something like Mend (formerly WhiteSource) in production?
~E
Trial first, ask later.