{
  "slug": "trivy",
  "name": "Trivy",
  "aliases": ["Aqua Trivy"],
  "vendor": { "name": "Aqua Security", "slug": "aqua-security", "website": "https://www.aquasec.com" },
  "homepage_url": "https://trivy.dev/",
  "docs_url": "https://trivy.dev/docs/latest/guide/",
  "repo_url": "https://github.com/aquasecurity/trivy",
  "license_url": "https://github.com/aquasecurity/trivy/blob/main/LICENSE",
  "product_type": "cli-tool",
  "product_status": "active",
  "summary": "Open-source scanner that finds known vulnerabilities, misconfigurations, exposed secrets and license issues in container images, file systems, git repositories, IaC and Kubernetes clusters",
  "description": "Trivy is a security scanner from Aqua Security released under Apache-2.0. One binary scans several kinds of targets: container images and their OS packages and language dependencies, local file systems and git repositories with lockfiles, infrastructure-as-code files (Terraform, CloudFormation, Kubernetes manifests, Dockerfiles, Helm charts), virtual machine images and running Kubernetes clusters. For each it reports known vulnerabilities from a regularly updated database, misconfigurations against built-in policies, hard-coded secrets and dependency licenses, and it can generate or consume SBOMs in CycloneDX and SPDX formats.\n\nIt is commonly wired into CI through official GitHub Actions and GitLab templates to fail builds on high-severity findings, run as a Kubernetes operator for continuous cluster scanning, or used interactively before pushing an image. Output formats include a table, JSON, SARIF and templates.\n\nTrivy detects known issues in packages and configuration; it does not analyze first-party source code logic, and results depend on accurate package metadata and a reachable or mirrored vulnerability database.",
  "capabilities": ["Vulnerability scanning of OS packages and language dependencies in images, file systems and repositories", "Misconfiguration checks for Terraform, Kubernetes, Dockerfiles, Helm and CloudFormation", "Secret detection and license reporting", "SBOM generation and scanning (CycloneDX, SPDX)", "Kubernetes cluster scanning and operator mode", "SARIF, JSON and template outputs for CI integration"],
  "workflows": ["Fail a CI build when an image contains critical vulnerabilities", "Audit Terraform and Kubernetes manifests before apply", "Produce an SBOM for a release artifact"],
  "advantages": ["Single binary covering many target types", "Apache-2.0 license with frequent database updates", "Straightforward CI integration"],
  "limitations": ["Finds known issues only; no first-party code analysis", "Requires database downloads or a mirror in restricted networks", "Policy coverage varies by IaC format"],
  "prerequisites": ["Trivy binary or container image", "Network access to the vulnerability database or a local mirror"],
  "audiences": ["DevOps and platform engineers", "Security teams scanning images and IaC"],
  "alternatives": ["semgrep"],
  "comparison_notes": "Semgrep analyzes patterns in first-party source code; Trivy looks at dependencies, images, configuration and clusters for known vulnerabilities and misconfigurations. Teams usually run both.",
  "categories": [{ "slug": "security-tools", "primary": true }, { "slug": "containers-virtualization" }],
  "tags": ["vulnerability-scanning", "containers", "sbom", "iac", "security", "cli", "ci", "open-source", "go"],
  "use_cases": ["scan-code-for-vulnerabilities", "orchestrate-containers"],
  "operating_systems": ["macos", "linux", "windows"],
  "execution_modes": ["local", "self-hosted"],
  "interfaces": ["cli"],
  "deployment_models": ["desktop", "on-premises"],
  "integrations": ["GitHub Actions", "GitLab CI", "Docker", "Kubernetes", "Harbor", "Terraform"],
  "data_formats": ["CycloneDX", "SPDX", "SARIF", "JSON"],
  "languages": ["Go"],
  "source_model": "open-source",
  "license_spdx": "Apache-2.0",
  "pricing_model": ["open-source", "free"],
  "self_hostable": true,
  "sources": [
    { "url": "https://trivy.dev/", "type": "official_site", "title": "Trivy", "supports": ["name", "summary", "vendor", "capabilities"], "checked_at": "2026-11-02" },
    { "url": "https://trivy.dev/docs/latest/guide/", "type": "official_docs", "title": "Trivy Documentation", "supports": ["capabilities", "data_formats", "workflows"], "checked_at": "2026-11-02" },
    { "url": "https://github.com/aquasecurity/trivy/blob/main/LICENSE", "type": "license_page", "title": "Trivy LICENSE (Apache-2.0)", "supports": ["license_spdx", "source_model"], "checked_at": "2026-11-02" }
  ],
  "confidence": "high",
  "discovery_method": "editorial-research",
  "depth": "standard",
  "editorial_status": "reviewed",
  "visibility": "public",
  "featured": false,
  "author": "batch-B2"
}