Comparison
Lockhound and Snyk
Snyk is a broad developer security platform. Lockhound does one part of that job, dependency risk across your GitHub repositories, and tries to make that part simple and cheap. The right column covers Snyk Open Source and the platform features around it.
Every claim about Snyk links to its own documentation, checked on 30 October 2026.
| Capability | Lockhound | Snyk |
|---|---|---|
| What it covers | Dependencies (known, exploited and malicious) and malware committed into repositories. Nothing else. | A platform: open source dependencies (SCA), code (SAST), infrastructure as code and containers.source |
| Pricing model | Flat price per plan with unlimited members; free for 5 private repositories and every public one. | Free plan with 5 projects and test limits (200 Open Source tests); Team from $25 a month for up to 10 developers; Enterprise priced per active contributor.source |
| GitHub access | Read-only repository contents; optional checks and issues. | The GitHub Cloud App asks for read and write access to contents, pull requests, checks and commit statuses.source |
| Vulnerability data | OSV, which includes the GitHub Advisory Database. | Snyk's own curated database, built from public sources and its security team's research.source |
| Exploited in the wild (CISA KEV) | Shown with the listing date, ranked first, alerted when newly listed. | Exploit maturity, including an "Attacked" level, draws on sources such as the CISA KEV catalog.source |
| EPSS | Shown as a prediction; orders findings within a priority. | One factor in the Risk Score, which is in Early Access.source |
| Reachability analysis | Not offered: Lockhound doesn’t analyse your application code. | Available for Java, JavaScript/TypeScript and Python; Snyk analyses your source code to do it.source |
| Malicious packages | Known malicious versions from the OpenSSF database, ranked first. | Curated by its security research team and reported as critical.source |
| Composer (PHP) | composer.lock with production and dev scopes, plus the exact composer commands to fix each finding. | Supported from composer.lock; Snyk documents that its Fix PR feature is not available for PHP.source |
| Opens fix pull requests | No. It gives the command, can open a fix issue, and can hand the fix to your AI coding agent on Business. | Automatic Fix PRs for many ecosystems (not PHP).source |
| Pull request checks | Fail only on what the pull request adds, on every plan. | Fail only if the new branch has more issues.source |
| Malware committed into the repository itself | Checks the files such attacks hide in, on the default branch and in pull requests. | Not found in Snyk's documentation (checked 30 October 2026). |
| Organization-wide reporting | One dashboard across every connected organization, on every plan. | Snyk Analytics is available on the Enterprise plan.source |
| SBOM export | CycloneDX and SPDX on Business. | The snyk sbom command (CycloneDX, SPDX) is for Enterprise plans.source |
| License compliance | Not offered. | License scanning is part of Snyk Open Source.source |
“Partly” means the feature exists with limits, such as a paid plan, a preview or a beta. Products change often; if something here is out of date, tell us and we'll fix it.
When Snyk is the better choice
If you want one vendor for dependencies, code, containers and infrastructure as code, automatic fix pull requests, license compliance, or reachability analysis for Java, JavaScript or Python, Snyk covers far more ground than Lockhound.
When Lockhound fits better
- Predictable cost for a whole team. Flat plans with unlimited members, rather than per developer, and no scan or test quotas.
- PHP and Laravel shops. Lockfile-accurate Composer scanning with production and dev scopes, and the exact commands to fix each finding.
- Least privilege. Read-only access to repository contents, and no source code analysis.
- Committed malware in build files and editor tasks, not only malicious packages.
What about detection rates?
We don't publish “finds X% more” claims. We will only publish detection numbers from a reproducible benchmark (fixed commits, the same time window, the method and raw results published with it). Until then, try both on your own lockfile.