# Snyk: Trust page changed

> Snyk announced it is standardizing repository file retrieval on Workspaces, using temporary Git cloning instead of fetching individual files through SCM providers' HTTP APIs. This changes how Snyk accesses repository contents for analysis; the Trust page also removed detailed text from its Keyv / Ca

Canonical: https://rewindex.com/change/p13843
Last updated: 2026-11-03T08:57:22Z

**Summary:** Snyk announced it is standardizing repository file retrieval on Workspaces, using temporary Git cloning instead of fetching individual files through SCM providers' HTTP APIs. This changes how Snyk accesses repository contents for analysis; the Trust page also removed detailed text from its Keyv / Cacheable supply-chain compromise update. _(machine-written, sol)_
- Kind: Trust / security · Label: Changed (not classified) (rule)
- Changed: 2026-11-03 08:57 UTC · Detected: 2026-11-03 08:57 UTC
- [Source: https://trust.snyk.io](https://trust.snyk.io)
- [Company: Snyk](https://rewindex.com/company/snyk.md)
- Versions: before page\_version:12090 → after page\_version:13843
- Change 4 of 4 for this page

## What changed

**1. Added**

```diff
  …Snyk's Privacy Policy and DPA? Updates View all
+ General Snyk is standardizing SCM file access on Workspaces Published ‹date› Snyk is standardizing how it retrieves repository files Temporary Git cloning is a common way for modern code security and CI/CD tools to retrieve repository contents for analysis. Snyk is standardizing on this model through what we call Workspaces, replacing the legacy method of fetching individual files through your SCM provider's HTTP API. This consolidates Snyk’s repository retrieval in one method; it does not change what Snyk can access. Snyk remains limited to the scope authorized by your SCM integration and, if you use Snyk Broker, by your Broker configuration. Snyk does not maintain a persistent repository clone. The temporary clone is removed after scan processing, while source data required for vulnerability analysis may remain in an encrypted cache for a maximum of 24 to 48 hours, depending on your region. Snyk Broker customers may need to update their Broker client or configuration. All other customers require no action. How Snyk handles your repository contents Retrieval is triggered by a scan. Snyk creates a temporary clone, within the region where your tenant is hosted, of a specific commit  …
  Opens in new tab . Read more Read…
```

**2. Added**

```diff
  …new tab . Read more Read more about
+ Snyk is standardizing SCM file access on Workspaces
  Security Brotli Decoder Remote Code Execution Vulnerability (CVE-2026-111497)…
```

**3. Removed**

```diff
  …Supply Chain Compromise Incident - Keyv / Cacheable
- - Update #1 Published ‹date› We are investigating an active supply chain compromise affecting multiple npm packages across several package families. Current reporting indicates that a compromised maintainer account was used to publish malicious versions to the npm registry on ‹date› , beginning with keyv@6.0.0 and cache-manager@7.2.10. The malware self-propagates
  using stolen npm publish credentials to inject itself…
```

**4. Removed**

```diff
  …credentials to inject itself into and republish additional
- packages, and has spread to hundreds of packages across many projects. The affected package and version list continues to grow. The malicious behavior includes credential harvesting from developer and CI/CD environments - npm, GitHub, cloud, and Vault credentials - and exfiltration to attacker-controlled infrastructure. It executes via both an npm preinstall script and IDE auto-run hooks (.claude/settings.json, .vscode/tasks.json), so simply opening an affected repository in an IDE or coding agent can trigger it. Initial Snyk advisories have been published, and the investigation remains ongoing. At this time, there is no confirmed Snyk customer impact. Snyk is not impacted. We will continue to monitor the situation and update this page as more information becomes available.
  For additional background and technical details, please refer…
```

**5. Removed**

```diff
  …becomes available. For additional background and technical details,
- please refer to
  the Snyk Blog post Opens in new tab…
```

_1 noise-only block(s) hidden (dates, counters, testimonials, tokens)._

## History of this page

| When (UTC) | Change | Label |
| --- | --- | --- |
| 2026-10-22 08:57 UTC | [Trust page changed](https://rewindex.com/change/p5414.md) | Changed (not classified) |
| 2026-10-29 09:03 UTC | [Trust page changed](https://rewindex.com/change/p10516.md) | Changed (not classified) |
| 2026-10-31 09:00 UTC | [Trust page changed](https://rewindex.com/change/p12090.md) | Changed (not classified) |
| 2026-11-03 08:57 UTC | Trust page changed (this change) | Changed (not classified) |

Previous: [change](https://rewindex.com/change/p12090.md) · All Snyk changes: [timeline](https://rewindex.com/company/snyk/changes.md)
_Diff excerpts are shown on normalized text: dates, counters and tokens appear as ‹date›, ‹count›, ‹tok›; noise-only edits are hidden. Rewindex shows the changed passages, not a copy of the page._

## Cite this

Trust page changed on Snyk’s Trust page, changed 2026-11-03 08:57 UTC (change 4 of 4).

- Canonical URL: https://rewindex.com/change/p13843
- Citation: Snyk, “Trust page changed” (2026-11-03 08:57 UTC). Archived by Rewindex: https://rewindex.com/change/p13843 (CC BY 4.0).
- Markdown link: `[Snyk: Trust page changed (2026-11-03)](https://rewindex.com/change/p13843)`


---
Canonical: https://rewindex.com/change/p13843 · Markdown: https://rewindex.com/change/p13843.md · JSON: https://rewindex.com/api/v1/changes/p13843 · Data licensed CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/) · Generated 2026-11-04T15:54:46.263Z