Snyk announced it is standardizing repository file retrieval on Workspaces, using temporary Git cloning instead of fetching individual files through SCM providers' HTTP APIs. This changes how Snyk accesses repository contents for analysis; the Trust page also removed detailed text from its Keyv / Cacheable supply-chain compromise update.
Machine-written from the diff below (Sol; type: other). Check the diff before relying on it.
What changed
Struck in red is what Snyk removed; blue is what they added. Muted text is unchanged context.
BeforeAfter
Added#1
Before: …Snyk's Privacy Policy and DPA? Updates View all nothing here Opens in new tab . Read more Read…
After: …Snyk's Privacy Policy and DPA? Updates View all General Snyk is standardizing SCM file access on Workspaces Published ‹date› Snyk is standardizing how it retrieves repository files Temporary Git cloning is a common way for modern code security and CI/CD tools to retrieve repository contents for analysis. Snyk is standardizing on this model through what we call Workspaces, replacing the legacy method of fetching individual files through your SCM provider's HTTP API. This consolidates Snyk’s repository retrieval in one method; it does not change what Snyk can access. Snyk remains limited to the scope authorized by your SCM integration and, if you use Snyk Broker, by your Broker configuration. Snyk does not maintain a persistent repository clone. The temporary clone is removed after scan processing, while source data required for vulnerability analysis may remain in an encrypted cache for a maximum of 24 to 48 hours, depending on your region. Snyk Broker customers may need to update their Broker client or configuration. All other customers require no action. How Snyk handles your repository contents Retrieval is triggered by a scan. Snyk creates a temporary clone, within the region where your tenant is hosted, of a specific commit … Opens in new tab . Read more Read…
Added#2
Before: …new tab . Read more Read more about nothing here Security Brotli Decoder Remote Code Execution Vulnerability (CVE-2026-111497)…
After: …new tab . Read more Read more about Snyk is standardizing SCM file access on Workspaces Security Brotli Decoder Remote Code Execution Vulnerability (CVE-2026-111497)…
Removed#3
Before: …Supply Chain Compromise Incident - Keyv / Cacheable - Update #1 Published ‹date› We are investigating an active supply chain compromise affecting multiple npm packages across several package families. Current reporting indicates that a compromised maintainer account was used to publish malicious versions to the npm registry on ‹date› , beginning with keyv@6.0.0 and cache-manager@7.2.10. The malware self-propagates using stolen npm publish credentials to inject itself…
After: …Supply Chain Compromise Incident - Keyv / Cacheable removed using stolen npm publish credentials to inject itself…
Removed#4
Before: …credentials to inject itself into and republish additional packages, and has spread to hundreds of packages across many projects. The affected package and version list continues to grow. The malicious behavior includes credential harvesting from developer and CI/CD environments - npm, GitHub, cloud, and Vault credentials - and exfiltration to attacker-controlled infrastructure. It executes via both an npm preinstall script and IDE auto-run hooks (.claude/settings.json, .vscode/tasks.json), so simply opening an affected repository in an IDE or coding agent can trigger it. Initial Snyk advisories have been published, and the investigation remains ongoing. At this time, there is no confirmed Snyk customer impact. Snyk is not impacted. We will continue to monitor the situation and update this page as more information becomes available. For additional background and technical details, please refer…
After: …credentials to inject itself into and republish additional removed For additional background and technical details, please refer…
Removed#5
Before: …becomes available. For additional background and technical details, please refer to the Snyk Blog post Opens in new tab…
After: …becomes available. For additional background and technical details, removed the Snyk Blog post Opens in new tab…
Compared with the previous archived version (#12090 to #13843). Text is normalized before comparing: dates, counters and tokens show as ‹date›, ‹count›, ‹tok›, and noise-only edits are hidden. Rewindex shows changed passages with a few words of context, not a copy of the page. View the live page (opens in new tab).
Archive proof
Rewindex commits each page capture it captures to a daily checkpoint, chains it to the day before, and has the checkpoint timestamped by FreeTSA and DigiCert. That proves these records existed by then and have not been changed since, by anyone, Rewindex included.
Snyk announced it is standardizing repository file retrieval on Workspaces, using temporary Git cloning instead of fetching individual files through SCM providers' HTTP APIs. This changes how Snyk accesses repository contents for analysis; the Trust page also removed detailed text from its Keyv / Cacheable supply-chain compromise update.
Snyk’s Trust page now says it is assessing potential impact to its environments and will prioritize remediation of any findings if necessary. The statement does not confirm whether Snyk is affected, so customer exposure remains unconfirmed in this update.
Snyk added a security advisory for Brotli CVE-2026-111497 (CVSS 9.2), recommending updates, restarts and container rebuilds. It clarifies that Open Source scanning misses runtimes; customers should also use Unmanaged scanning and Snyk Container to find affected copies. The Klue/Salesforce investigation closing notice and documentation-on-request text were removed.
Snyk added a PHP zero-day notice covering CVE-2026-109618 / CVE-2026-109619: critical vulnerabilities (CVSS 9.2) that can allow unauthenticated remote code execution, with PHP security updates released October 21. This is relevant to customers running PHP installations serving web requests. The page also removed the Klue incident summary preview, without indicating resolution.
Cite this
Trust page changed on Snyk’s Trust page, changed 2026-11-03 08:57 UTC (change 4 of 4).