Trivy
by Aqua Security
Find vulnerabilities, misconfigurations, and secrets in containers and code
Trivy is a comprehensive security scanner for container images, filesystems, Git repositories, Kubernetes clusters, and IaC files. It detects known vulnerabilities, misconfigurations, exposed secrets, and license issues, and generates SBOMs. After a March 2026 supply-chain compromise of some release artifacts and GitHub Action tags, which the maintainers have since remediated, pinning releases and actions by digest or commit SHA is recommended.
Key features
- Container image and filesystem scanning
- IaC misconfiguration checks
- Secret and license detection
- SBOM generation
Similar tools
OSV-Scanner
Scan dependencies for known vulnerabilities using the OSV.dev database
CodeQL
GitHub's semantic code analysis engine for finding vulnerabilities
Semgrep
Lightweight static analysis for finding bugs and enforcing code standards
TruffleHog
Find and verify leaked credentials in code, history, and cloud storage
ZAP
Open-source web application security scanner and intercepting proxy
Docker Desktop
Build, run, and share containerized applications on your desktop
