Two cultures, one product, in under five months.
DeepCode was a small, research-led startup. Snyk was an established scale-up with its own platform, patterns and customers. Merging the two was hard at times, and it paid off. We had to turn DeepCode’s engine into a product that felt native to Snyk, and we had one release window to do it.
We ran it as a series of Google Design Sprints: map the problem, sketch, prototype, and test with customers within the week. We went through many iterations and took in a lot of feedback. Less than five months later we released a beta that did well and became the foundation of Snyk Code as it is today.
Let customers teach the engine about their own code.
SAST is hard. Whatever the approach, no engine covers 100% of what customers need. The gap shows up most with custom code: an in-house sanitizer that the engine doesn’t recognise produces false positives, and false positives cost developers’ trust.
Rules extensions let teams tell Snyk Code how to interpret specific code, starting with marking a function as a sanitizer directly from an issue. PM and I worked on it closely, with a lot of support from the engineering team, and tested it with customers who had the problem.
I designed and built AI Fix for VS Code.
Snyk AI Fix (Autofix) fixes supported vulnerabilities right where developers find them. In 2024, with most of the team committed to foundational work for the year, I took responsibility for bringing it to VS Code.
I designed the experience, wrote the UI myself and coordinated the developers working on the backend. The work paid off: AI Fix was shown on stage at Google Next 2024.
- db.query("SELECT * FROM users WHERE id=" + id) + db.query("SELECT * FROM users WHERE id=?", [id]) ✦ Apply AI Fix
Meet developers in the pull request.
Most developers don’t like security. It’s one more thing on an already long list. Asking them to open another dashboard makes that worse.
So we brought Snyk into code review. New issues appear as inline PR comments with the data flow, a risk score and a CWE link. Developers act on them by replying: @snyk /fix suggests a fix, /apply commits it, /explain explains the issue, and /ignore dismisses it with a reason.
I checked technical feasibility with engineering before we committed to the design, and wrote parts of the UI myself.
Envisioning Snyk 2.0: from fixing one issue to a fix plan.
Fixing one issue at a time wasn’t enough. Codebases keep growing, and while the worst issues get blocked before deploy, most known risk stays in the code.
The AI Fix Plan starts from what security leaders (CISOs, AppSec teams, security champions) care about most, turns that into a prioritized plan, and guides developers through fixing it one step at a time. I prototyped it, got stakeholders aligned on the direction, and built a proof of concept.
A beta that grew into one of Snyk's core products.
- From acquisition to beta
- <5mo
- Snyk Code ARR · 2024
- $100M+
- AI Fix on stage
- Next'24
- Surfaces designed
- 4