Trivy

Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.

Targets (what Trivy can scan):

• Container Image

• Filesystem

• Git Repository (remote)

• Virtual Machine Image

• Kubernetes

• AWS

Scanners (what Trivy can find there):

• OS packages and software dependencies in use (SBOM)

• Known vulnerabilities (CVEs)

• IaC issues and misconfigurations

• Sensitive information and secrets

• Software licenses

Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page.

To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.