How to Run a Dependency Security Scan in CircleCI

By Kaveh Alemi·Latchkey

Scan dependencies in CircleCI with the Snyk orb for rich SCA, or a zero-dependency npm audit step.

Use the snyk/snyk orb to scan and optionally fail on a severity threshold, or run npm audit directly when you just need a lightweight dependency gate.

Snyk orb scan with a threshold

The orb runs a vulnerability scan and fails the job on high-or-worse findings.

version: 2.1
orbs:
  snyk: snyk/snyk@2

jobs:
  scan:
    docker:
      - image: cimg/node:20.11
    steps:
      - checkout
      - run: npm ci
      - snyk/scan:
          severity-threshold: high
          fail-on-issues: true

Gotchas

• The Snyk orb needs SNYK_TOKEN set in a context or project env var.
• Set severity-threshold so low-severity advisories do not block every build.
• For a no-orb option, npm audit --audit-level=high works but lacks Snyk's fix advice and monitoring.

Verify it actually works

• Trigger the real event rather than a manual run. Manual dispatch populates a different context, so behaviour depending on the event will differ.
• Assert on the outcome, not on the step exiting zero. Many steps report success while producing nothing.
• Check it on a fresh runner with a cold cache once, so you are not testing warm state that will not exist on the next contributor machine.

Frequently asked questions

Related guides

References

• GitHub Actions documentation