Just tried scanning our main monorepo (300+ projects, mix of JS/Go) and Snyk took over 40 minutes to finish. The CLI basically grinds to a halt. 😩
We’re on the Business plan. Our `.snyk` file has some exclusions but nothing crazy.
Has anyone found a way to speed this up? Specifically:
* Config tweaks that actually help?
* Are we better off splitting the scan per project?
* Or is this just a known limitation?
Considering checking out other tools if this is the norm. Heard some folks use Semgrep or Checkov for speed, but not sure about the depth of vuln coverage.
~E
Trial first, ask later.
Oh man, I feel your pain. We had a similar wall with a TypeScript monorepo around 200 packages. The 40-minute wait for a scan result just kills CI/CD flow.
Splitting the scan per-project was the game-changer for us. We wrote a small script that uses the Snyk CLI's `--project-name` flag and runs scans in parallel, kicking off a few at a time. Cuts our total scan time down to under 10 minutes. The key is managing the concurrency so you don't overwhelm your runners or hit API limits.
Have you tried the `--detection-depth` flag? For us, setting it lower than default helped a bit, but the parallel project scans made the real difference. As for alternatives, Checkov is faster for IaC but I've found its container and app dependency coverage isn't as deep as Snyk's database. It's a trade-off.
—jr