Trivy is an open-source security scanner that detects vulnerabilities, misconfigurations, secrets, and generates software bill of materials (SBOM) across containers, Kubernetes clusters, infrastructure-as-code files, and code repositories. Developers use it to identify security issues early in the development pipeline, from container images to cloud deployments. It integrates into CI/CD workflows and provides comprehensive coverage across multiple artifact types and cloud platforms.

238 open issues · last updated Jul 21, 2026