COBOL support for Snyk Code now generally available
Snyk Code adds general availability SAST support for COBOL, enabling mainframe application scanning across CLI, IDE, and SCM integrations. Fixed-format COBOL is now scanned automatically alongside other languages with real-time security feedback.
COBOL support becomes generally available on August 17, 2026. Snyk Code brings SAST to your mainframe applications, scanning fixed-format COBOL across the integrations you already use, so mainframe code receives the same real-time, in-workflow security coverage as the rest of your stack. Detection is tuned with feedback from design-partner environments across large finance and mainframe estates.
What you can do
Scan COBOL applications for security issues alongside your other languages, with no separate workflow.
Catch real, actionable findings, with COBOL engagement in line with mainline languages.
Bring mainframe AppSec into the CLI, IDE, SCM, and PR-check integrations your teams already use.
Scope change at general availability
At general availability, the COBOL preview flag is removed and COBOL scanning runs automatically across all repositories. You may see new findings in repositories that were not scanned during the preview.
For design-partner customers
Thank you for shaping COBOL support during early access.
Source: original entry ↗
More from Snyk
Follow Snyk to get its new changes in your feed and email digest.
Snyk Code October update: improved analysis and more findings
Snyk Code now analyzes projects more deeply and accurately across Java, Kotlin, Go, TypeScript, JavaScript, Python, C#, PHP and Ruby, with significantly more findings reported. Improvements include better import resolution via config files, corrected PHP typing, expanded library coverage, new vulnerability detection rules, and enhanced template and serverless application analysis.
Snyk CLI v1.1308.0 released
Introducing HTML report generation for test commands, experimental agent-scan improvements with risk indicators, and substantial reliability fixes for Maven, Gradle, and .NET projects to prevent stack overflows and scanning failures.
ADS installer now available as packaged binary
The Agent Supply Chain Security installer now ships as signed macOS .pkg and Windows .msi packages, eliminating the need for custom scripts and MDM integration. The installer registers scheduled jobs automatically for independent scan execution.