Document snyk usage

[anselmbradford]

Current behavior

• snyk dependency is used for running npm run test, however, this requires an authenticated snyk account. (snyk test requires an authenticated account. Please run snyk auth and try again.). There is documentation on why snyk is in the project or how it should be setup.

Expected behavior

• When/why/how to use npm run test is documented in the project testing docs.

[anselmbradford]

@ascott1 Since we're trialling snyk.io accounts, is having a command in the project necessary?

[ascott1]

Since we're trialling snyk.io accounts, is having a command in the project necessary?

I'd lean towards no, assuming we have a process for monitoring/resolving snyk alerts.

[saracope]

Is this still an issue you want help on? Wasn't sure based on the conversation above. Thanks!

[anselmbradford]

Hi @saracope,

We could use a section in above https://cfpb.github.io/consumerfinance.gov/other-front-end-testing/#performance-testing for "Security testing" that lists running yarn test (formerly npm test) to run the snyk tests. We also have #2303, but looks like I ran into issues there.