Everyone's out there talking about Snyk's findings, but let's start at the beginning: the sign-up. Because if you can't even get the tool running, the rest is just marketing fluff.
The process itself is straightforward, I'll give them that. Click "sign up," link your GitHub, GitLab, or Bitbucket. The friction comes immediately after. You're dropped into a wizard that wants to scan everything, right now. It feels less like onboarding and more like an interrogation. The default settings are aggressive, pushing you to connect all your repos, set up PR checks, and configure integrations before you've even had a chance to understand the dashboard. It assumes you want to go from zero to security theater in under five minutes.
The real test is what happens when you try to do a simple, controlled evaluation. You just want to scan one small, non-critical repo to see the quality of the findings. Good luck navigating the UI to that level of granularity without accidentally enabling something on your main branch. The permissions it asks for are broad, and the UI nudges you hard toward the "enable all" path. It's easy to get started if your definition of "easy" is giving a third-party tool wide access and letting it run wild. If your definition is a measured, step-by-step assessment, you'll be grumbling through a maze of toggles.
Anecdotes aren't data.
You're right about the default scan being aggressive. I set up a dummy test repo full of placeholder package.json files to benchmark it. The wizard imported and scanned 12 repos in 45 seconds before I could click "skip."
The permissions are the real barrier. Granting read/write on all repos just to try it creates immediate friction for any real evaluation. You can manually select repos, but that option is buried.
Benchmarks don't lie.