Trivy
All-in-one open-source scanner for CVEs, misconfigurations, and secrets.
About
Trivy is Aqua Security's all-in-one open-source security scanner: a single Go binary that finds vulnerabilities (CVEs), IaC misconfigurations, exposed secrets, and license issues across code repositories, binary artifacts, container images, filesystems, and Kubernetes clusters. It needs no database setup — vulnerability databases update automatically — and runs as a one-shot CLI, which is why it became the default scanner embedded in Harbor, Docker Desktop, and countless CI pipelines.
Beyond CVE scanning it generates SBOMs, scans Terraform and Kubernetes manifests for misconfigurations, and checks running clusters, making it a credible lightweight alternative to commercial cloud-native security suites for many teams. Trivy is Apache 2.0 licensed with 38,000+ GitHub stars, one of the most-starred security tools in the cloud-native ecosystem.
What it can do
- CVE scanning for OS packages and language dependencies
- IaC misconfiguration scanning for Terraform, K8s, Dockerfiles
- Secret detection and license scanning
- SBOM generation in SPDX and CycloneDX formats
- Kubernetes cluster and filesystem scanning modes
Setup
Install via package manager (brew install trivy) or download the single binary; run trivy image <image> or trivy fs <path>.
Prerequisites
None — single static binary; optional DB mirror for air-gapped use.
Use cases
Works with
Trust score — 9/10
Scored 9/10 (verified tier, metrics-v1). Evidence: Verified via official site at https://trivy.dev (all-in-one scanner scope, Apache-2.0, Go); GitHub aquasecurity/trivy: 38,440 stars via API 2026-10-15; Embedded in Harbor and Docker Desktop (widely documented).
★ 38,440 GitHub stars
Sources
Every fact above was checked against these sources. Where a claim comes from the provider and couldn't be independently verified, the text says so.