# Trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

Repository: https://github.com/aquasecurity/trivy
Canonical: https://ross.abutalabs.com/products/trivy
Homepage: https://trivy.dev
Language: Go
License: Apache-2.0
License Family: permissive
Topics: security, security-tools, docker, containers, vulnerability-scanners, vulnerability-detection, vulnerability, golang, go, kubernetes, hacktoberfest, devsecops, misconfiguration, infrastructure-as-code, iac
Last push: 2026-08-21T13:35:07+00:00
Link (homepage): https://trivy.dev
Link (site_page): https://trivy.dev/docs/latest/getting-started
Link (site_page): https://trivy.dev/docs

## Health v2 (maintenance only)
Score: 98/100 (v2, computed 2026-09-03T02:20:16.233290+00:00)
- activity 98, release rhythm 98, longevity 100
- inputs: {"age_days": 2702, "days_push": 12, "days_rel": 19, "gap_med": 12.0, "n_releases_24m": 9}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 37636, forks 635 (observed 2026-08-28T04:12:01.491870+00:00)

## What it is
Trivy is an all-in-one open-source security scanner that finds vulnerabilities (CVEs), IaC misconfigurations, secrets, and software licenses across container images, filesystems, git repositories, VM images, and Kubernetes clusters. It is a Go-based CLI tool with integrations including a GitHub Action, a Kubernetes operator, and a VS Code extension.

## Use cases
- scan container images for known CVEs before pushing to a registry
- find exposed secrets and API keys in a code repository
- detect Terraform and Kubernetes misconfigurations in IaC files
- generate an SBOM of OS packages and dependencies
- audit a Kubernetes cluster for security issues
- add vulnerability scanning to CI/CD pipelines with GitHub Actions
- check software license compliance across dependencies

## When to choose
- you need a single free tool covering vulnerabilities, secrets, misconfigurations, and SBOM generation
- you want container, Kubernetes, filesystem, and git repo scanning in one CLI
- you need easy CI/CD integration via GitHub Actions or a Kubernetes operator
- you want a widely adopted, actively maintained scanner with permissive Apache-2.0 licensing

## When to avoid
- you need full commercial security management with policy enforcement and reporting dashboards
- you require dynamic application security testing (DAST) or runtime threat detection
- you need SAST for deep code-flow analysis rather than dependency and config scanning

## Facets
- artifact type: cli-tool
- maturity: stable
- function: vulnerability-scanning, security, dependency-audit, secrets-management, infrastructure-as-code, developer-tools, ci-cd
- domain: security, cloud-computing, developer-tools
- platform: windows, cli, go
- tags: sbom, cve-scanning, misconfiguration-detection, secret-scanning, container-security, kubernetes-security, iac-scanning, devsecops, license-compliance, devops, containers, linux, macos, docker, kubernetes

## Member repositories
- aquasecurity/trivy (main) score 98
- aquasecurity/trivy-operator (backend) score 99
- aquasecurity/trivy-action (plugin) score 88

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:12:01.491870+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T16:25:22.819134+00:00, confidence not recorded.
  - readme: https://github.com/aquasecurity/trivy (fetched 2026-08-28T04:12:01.491870+00:00, sha b04221382fc2)
  - homepage: https://trivy.dev (fetched 2026-08-29T07:47:10.533479+00:00, sha 4f7592ce3fab)
  - site_page: https://trivy.dev/docs/latest/getting-started (fetched 2026-08-29T07:47:10.536528+00:00, sha faea6d27bd87)
  - site_page: https://trivy.dev/docs (fetched 2026-08-29T07:47:10.538667+00:00, sha 0f971f3f3e2e)
- Data as of 2026-08-30T08:39:29.467469+00:00.