aquasecurity/trivy

Trivy is a security scanning tool that checks your software and infrastructure for known problems before they reach production. The central challenge in modern software development is that every container image, code repository, and cloud configuration is a potential source of security vulnerabilities, leaked secrets, or misconfigured settings, and manually reviewing all of them is not practical. Trivy automates that review in a single command. The tool works by accepting a target, a container image, a local filesystem directory, a remote Git repository, a virtual machine image, or an entire Kubernetes cluster, and running a set of scanners against it. The vulnerability scanner checks software packages and libraries against a database of known CVEs (Common Vulnerabilities and Exposures), which are publicly disclosed security flaws. The secrets scanner looks for things like API keys, passwords, or tokens that were accidentally committed to code. The misconfiguration scanner reviews Infrastructure-as-Code files such as Terraform or Kubernetes manifests for settings that deviate from security best practices. Trivy can also produce a Software Bill of Materials (SBOM), which is a complete inventory of every dependency in a project, along with their open-source licenses. You would use Trivy in a DevSecOps pipeline, meaning a software delivery process that includes security checks alongside development. It plugs into GitHub Actions, works as a Kubernetes operator for continuous cluster monitoring, and has a VS Code extension for checking code as you write it. It is written in Go, so it ships as a single binary with no runtime dependencies, and it is available via common package managers like Homebrew or as a Docker image.