Feature description
SNYK_TOKEN was only just added as a working secret (previously the snyk.yml workflow existed but always failed on missing auth). The first real scan against main found 3 high-severity CVEs (two in postcss, one in next itself), now fixed by the Next.js 16 upgrade in #1766. There's currently no process for what happens the next time Snyk finds something.
Problem this solves
A security scan that runs in CI but has no defined response process just becomes background noise that gets ignored the next time it goes red — exactly the failure mode this repo already hit once before the token was even configured.
Proposed solution
A lightweight documented process: e.g., a recurring scheduled issue/reminder (or a GitHub Action that opens an issue automatically) when Snyk finds new high/critical findings, with an expectation of triage within N days. Could also cover reviewing Dependabot's own auto-generated update PRs against Snyk's findings for overlap.
Alternatives considered
Fully automated auto-merge of Snyk/Dependabot fixes — riskier for a project with no paid CI minutes to spare on failed auto-merges; a human-triage cadence is the safer v1.
Feature description
SNYK_TOKENwas only just added as a working secret (previously thesnyk.ymlworkflow existed but always failed on missing auth). The first real scan againstmainfound 3 high-severity CVEs (two inpostcss, one innextitself), now fixed by the Next.js 16 upgrade in #1766. There's currently no process for what happens the next time Snyk finds something.Problem this solves
A security scan that runs in CI but has no defined response process just becomes background noise that gets ignored the next time it goes red — exactly the failure mode this repo already hit once before the token was even configured.
Proposed solution
A lightweight documented process: e.g., a recurring scheduled issue/reminder (or a GitHub Action that opens an issue automatically) when Snyk finds new high/critical findings, with an expectation of triage within N days. Could also cover reviewing Dependabot's own auto-generated update PRs against Snyk's findings for overlap.
Alternatives considered
Fully automated auto-merge of Snyk/Dependabot fixes — riskier for a project with no paid CI minutes to spare on failed auto-merges; a human-triage cadence is the safer v1.