Snyk's Free Plan Is 200 Tests a Month. Here Is What Counts as One.
Snyk's free plan counts scans, not repositories, and a monorepo burns through the allowance faster than almost anyone expects.
Snyk Free gives 200 Open Source tests, 100 Snyk Code tests, 300 IaC tests and 100 Container tests per month, across up to 5 projects. Scans of public repositories do not count against any of those limits, and the plan is permanent rather than a trial, with no card required.
The limit is measured in scans, so how many repositories you can protect depends on how often you scan and how many manifest files each one has.
Rohit Bhadani runs infrastructure day to day. This is the third security scanner he has evaluated for a small team, and the first where the free limit was decided before the trial ended.
What counts as a test?
A test is one scan of one target, and the target differs by product. Snyk Open Source counts each manifest file it scans, so a repository with a package.json at the root and three more inside workspaces consumes four tests on the first scan, not one.
| Product | Free monthly tests | One test means |
|---|---|---|
| Snyk Open Source (SCA) | 200 | One manifest file scanned: package.json, requirements.txt, pom.xml, go.mod |
| Snyk Code (SAST) | 100 | One scan of one repository |
| Snyk IaC | 300 | One Terraform, CloudFormation or Kubernetes file scanned |
| Snyk Container | 100 | One image or Dockerfile scanned |
The manifest-file detail is the one that surprises people. It is also the rule that makes the difference between a free plan that lasts a month and one that lasts nine days.
How fast does 200 tests actually run out?
Here is the arithmetic with a realistic monorepo. Twenty package.json files, scanned once a day by CI, spends 20 Open Source tests per run. Two runs a day for five working days is 200 tests, and the allowance is gone before the second week of the month ends.
That is not a hypothetical. A monorepo with 20 services is unremarkable at a company of ten people, and daily scheduled scans are the default recommendation in every CI guide, including Snyk's own.
| Shape of your repos | Tests per scan | Scans before the wall | Practical lifetime |
|---|---|---|---|
| 1 repo, 1 manifest, manual scans | 1 | 200 | Months |
| 3 repos, 3 manifests, daily CI | 3 | 66 | About 2 months |
| 10 repos, 10 manifests, daily CI | 10 | 20 | 20 days |
| Monorepo, 20 manifests, 2x daily | 20 | 10 | 5 working days |
What the free plan does not give you
The test cap is the visible limit. Three others matter more once you are inside a team rather than working alone.
- License compliance is not included. It arrives with the Team plan, so on Free you can see that a dependency has a license you might not want, and nothing tells you when that changes.
- Jira integration is not included. Findings have to be read in Snyk's own interface. In practice this is the limit that decides whether anyone looks at them.
- Overuse is paused, not billed. When the monthly allowance runs out, tests stop rather than continuing with an overage charge. Nothing breaks, and nothing is scanned either.
When Snyk Free is genuinely enough
If your codebase is open source, Snyk Free is effectively unlimited and the limits above do not apply to you. Public repository scans are excluded from every quota. For a maintainer working on public projects this is close to a full product at no cost, and it is the strongest argument for the plan.
For private code, the honest ceiling is one to three active repositories with scans on a schedule you set deliberately. That covers a solo developer, a contractor managing a handful of client projects, or a small team that scans before a release rather than every commit.
How to stay inside 200 tests without missing a vulnerability
Scan on change, not on schedule. A CI job that runs snyk test only when dependency files change spends a fraction of the allowance and catches the same class of problem, because new vulnerabilities in unchanged dependencies arrive through advisories that Snyk re-evaluates continuously rather than through re-scans.
Turn off duplicate CI runs on every branch. If a pull request triggers a scan and the merge to main triggers another, that is two tests for one change. Running on pull requests only, with a weekly snyk monitor for advisories, keeps a ten-repository project around 40 to 60 Open Source tests a month.
Keep private repositories private, and keep a demo or template repository public. It sounds like a small trick, and it is worth roughly a quarter of your monthly allowance.
Frequently asked questions
Does Snyk's free plan require a credit card?
No card is required to start. The Free plan is permanent rather than a trial, so there is no expiry date to work around.
What happens when the free tests run out?
Scanning pauses for the rest of the billing period and the quota resets at the next period. You are not charged for overage, and no test runs against the limit.
Do scans from the IDE count?
Tests run through Snyk's IDE plugin are not counted against the limit on any plan. The CLI and CI runs are what spend the allowance.
Is Snyk still free for open source?
Yes, and public repository scans do not count against any of the four quotas. This has been Snyk's published position for years.
Is 5 projects a hard limit?
The Free plan supports up to 5 projects. The test allowance is the limit most people reach first, and on a large monorepo you can hit the tests cap without ever approaching five projects.
Free-tier limits verified against Snyk's plan page on 30 September 2026. Limits change without notice.
