# CodeSync SI vs Snyk and DeepSource

Snyk and DeepSource are dedicated security and review platforms. CodeSync SI's audit is a short list of patterns, not a vulnerability database.

## The short version

Snyk is known for dependency, container, and code vulnerability scanning against an advisory database. DeepSource is known for automated review analyzers in pull requests. CodeSync SI's security audit, on Expert and Extreme only, checks for AWS access key ids, Stripe live secret keys, PEM private keys, package.json ranges set to * or latest, and a missing lockfile. It then includes the normal diagnose findings.

That audit will miss most CVEs. If you need an advisory database, use a product built for it and keep CodeSync SI for the repair pass and the local model.

## What the audit is for

It is a fast, explicit check before you hand a tree to a model or open a repair pull request. Standard does not include it. The finding text is stored on the run so you can see what matched.

## Related

- [Security audits](https://codesyncsi.com/use/security-audits)
- [CodeSync SI vs SonarQube](https://codesyncsi.com/compare/sonarqube)
- [/pricing](https://codesyncsi.com/pricing)