What it does
Trivy scans software and infrastructure targets for known vulnerabilities and can also check for misconfigurations, exposed secrets, licenses, and software bills of materials. It is commonly placed before an artifact is published or deployed, where a pipeline can inspect a source tree, image, or cluster. It reports findings; teams still need to decide how to remediate or accept them.
Scan a concrete target
Trivy's command pattern pairs a target type with the subject to inspect. Official first-step examples include scanning a filesystem for vulnerabilities, secrets, and misconfigurations, and scanning a container image for known vulnerabilities. For example, a CI job could run a filesystem scan against the checked-out source before building an image, then scan the image before publishing it. The example is illustrative; no command was run during this research.
The scanner supports more than one point in the software supply chain: source repositories, binary artifacts, container images, and Kubernetes clusters. That makes it useful as a security-check stage, but the scanned subject and enabled scanner determine what the report can say. A source scan is not a runtime test, and a vulnerability report does not itself patch a dependency or replace a team's triage policy.
The project is available as a command-line tool, container image, and through package or binary installation options. The official repository publishes Trivy under Apache License 2.0. In CI, pin the tool version and decide how the job should handle findings; the scanner produces evidence for a policy rather than making every remediation decision on a team's behalf.
Strengths
- Scans several distinct targets, including filesystems, repositories, container images, and Kubernetes clusters.
- Can identify more than vulnerabilities, including misconfigurations, secrets, licenses, and SBOM data.
- The project is free and distributed under Apache License 2.0.
Watch out for
- A scan reports issues but does not automatically repair application dependencies or infrastructure configuration.
- What a scan can detect depends on its target, enabled scanners, and the source data available to it.
Best for
- Adding vulnerability and misconfiguration checks to a CI pipeline
- Scanning a container image before publishing it
- Generating security findings or SBOM data for software artifacts
Sources
- Trivy (Oct 25, 2026)
- First steps | Trivy (Oct 25, 2026)
- LICENSE | aquasecurity/trivy (Oct 25, 2026)
- aquasecurity/trivy (Oct 25, 2026)