    Skip to content

      Navigation Menu

            Sign in Appearance settings
                * Platform
                        + AI CODE CREATION
                            o GitHub Copilot Write better code with AI
                            o GitHub Copilot app Direct agents from issue to merge
                            o MCP Registry Integrate external tools
                        + DEVELOPER WORKFLOWS
                            o Actions Automate any workflow
                            o Codespaces Instant dev environments
                            o Issues Plan and track work
                            o Code Review Manage code changes
                            o Code Quality Enforce quality at merge
                        + APPLICATION SECURITY
                            o GitHub Advanced Security Find and fix vulnerabilities
                            o Code security Secure your code as you build
                            o Secret protection Stop leaks before they start
                        + EXPLORE
                            o Why GitHub
                            o Documentation
                            o Blog
                            o Changelog
                            o Marketplace
                      View all features
                * Solutions
                        + BY COMPANY SIZE
                            o Enterprises
                            o Small and medium teams
                            o Startups
                            o Nonprofits
                        + BY USE CASE
                            o App Modernization
                            o DevSecOps
                            o DevOps
                            o CI/CD
                            o View all use cases
                        + BY INDUSTRY
                            o Healthcare
                            o Financial services
                            o Manufacturing
                            o Government
                            o View all industries
                      View all solutions
                * Resources
                        + EXPLORE BY TOPIC
                            o AI
                            o Software Development
                            o DevOps
                            o Security
                            o View all topics
                        + EXPLORE BY TYPE
                            o Customer stories
                            o Events & webinars
                            o Ebooks & reports
                            o Business insights
                            o GitHub Skills
                        + SUPPORT & SERVICES
                            o Documentation
                            o Customer support
                            o Community forum
                            o Trust center
                            o Partners
                      View all resources
                * Open Source
                        + COMMUNITY
                            o GitHub Sponsors Fund open source developers
                        + PROGRAMS
                            o Security Lab
                            o Maintainer Community
                            o Accelerator
                            o GitHub Stars
                            o Archive Program
                        + REPOSITORIES
                            o Topics
                            o Trending
                            o Collections
                * Enterprise
                        + ENTERPRISE SOLUTIONS
                            o Enterprise platform AI-powered developer platform
                        + AVAILABLE ADD-ONS
                            o GitHub Advanced Security Enterprise-grade security features
                            o Copilot for Business Enterprise-grade AI features
                            o Premium Support Enterprise-grade 24/7 support
              * Pricing
                Type / to search
                Sign in
              Sign up Appearance settings
      You signed in with another tab or window. Reload to refresh your session. You signed out in another tab or window. Reload to refresh your session. You switched accounts on another tab or window. Reload to refresh your session. Dismiss alert

              Uh oh!

              There was an error while loading. Please reload this page.

              aquasecurity / trivy Public
              * Notifications You must be signed in to change notification settings
              * Fork 578
                * Star 37.3k
          * Code
          * Issues 164
          * Pull requests 82
          * Discussions
          * Actions
          * Projects
          * Security and quality 5
          * Insights
          Additional navigation options
                  * Code
                  * Issues
                  * Pull requests
                  * Discussions
                  * Actions
                  * Projects
                  * Security and quality
                  * Insights
                                              main
                                          Branches Tags
                                            Go to file
                                        Code
                                          Open more actions menu

                                        Folders and files

                                          Name                                   Name                                     Last commit message    Last commit date
                                            Latest commit                      
                                                                               
                                                History                        
                                                                               
                                                4,168 Commits                  
                                                  4,168 Commits                
                                                  .github                                .github                                                                 
                                                  .vex                                   .vex                                                                    
                                                  brand                                  brand                                                                   
                                                  ci                                     ci                                                                      
                                                  cmd/ trivy                             cmd/ trivy                                                              
                                                  contrib                                contrib                                                                 
                                                  docs                                   docs                                                                    
                                                  e2e                                    e2e                                                                     
                                                  examples                               examples                                                                
                                                  helm/ trivy                            helm/ trivy                                                             
                                                  integration                            integration                                                             
                                                  internal                               internal                                                                
                                                  magefiles                              magefiles                                                               
                                                  misc                                   misc                                                                    
                                                  pkg                                    pkg                                                                     
                                                  rpc                                    rpc                                                                     
                                                  schema                                 schema                                                                  
                                                  .dockerignore                          .dockerignore                                                           
                                                  .gitattributes                         .gitattributes                                                          
                                                  .gitignore                             .gitignore                                                              
                                                  .golangci.yaml                         .golangci.yaml                                                          
                                                  .release-please-manifest.json          .release-please-manifest.json                                           
                                                  CHANGELOG.md                           CHANGELOG.md                                                            
                                                  CONTRIBUTING.md                        CONTRIBUTING.md                                                         
                                                  Dockerfile                             Dockerfile                                                              
                                                  Dockerfile.canary                      Dockerfile.canary                                                       
                                                  LICENSE                                LICENSE                                                                 
                                                  NOTICE                                 NOTICE                                                                  
                                                  README.md                              README.md                                                               
                                                  SECURITY.md                            SECURITY.md                                                             
                                                  buf.gen.yaml                           buf.gen.yaml                                                            
                                                  buf.yaml                               buf.yaml                                                                
                                                  go.mod                                 go.mod                                                                  
                                                  go.sum                                 go.sum                                                                  
                                                  goreleaser-canary.yml                  goreleaser-canary.yml                                                   
                                                  goreleaser.yml                         goreleaser.yml                                                          
                                                  mkdocs.yml                             mkdocs.yml                                                              
                                                  release-please-config.json             release-please-config.json                                              
                                                  zizmor.yml                             zizmor.yml                                                              
                                            View all files                     
                                          

                                              Repository files navigation

                                                * 
                                                * README
                                                * Code of conduct
                                                * Contributing
                                                * Apache-2.0 license
                                                * Security
                                                More items

                                                📖 Documentation

                                              Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.

                                              Targets (what Trivy can scan):

                                                * Container Image
                                                * Filesystem
                                                * Git Repository (remote)
                                                * Virtual Machine Image
                                                * Kubernetes

                                              Scanners (what Trivy can find there):

                                                * OS packages and software dependencies in use (SBOM)
                                                * Known vulnerabilities (CVEs)
                                                * IaC issues and misconfigurations
                                                * Sensitive information and secrets
                                                * Software licenses

                                              Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page.

                                              To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.

                                                Quick Start

                                                Get Trivy

                                              Trivy is available in most common distribution channels. The full list of installation options is available in the Installation page. Here are a few popular examples:

                                                * brew install trivy
                                                * docker run aquasec/trivy
                                                * Download binary from https://github.com/aquasecurity/trivy/releases/latest/
                                                * See Installation for more

                                              Trivy is integrated with many popular platforms and applications. The complete list of integrations is available in the Ecosystem page. Here are a few popular examples:

                                                * GitHub Actions
                                                * Kubernetes operator
                                                * VS Code plugin
                                                * See Ecosystem for more

                                                Canary builds

                                              There are canary builds (Docker Hub, GitHub, ECR images and binaries) generated with every push to the main branch.

                                              Please be aware: canary builds might have critical bugs, so they are not recommended for use in production.

                                                General usage

                                                trivy <target> [--scanners <scanner1,scanner2>] <subject>

                                              Examples:

                                                trivy image python:3.4-alpine
                                              Result image.mp4
                                                trivy fs --scanners vuln,secret,misconfig myproject/
                                              Result fs.mp4
                                                trivy k8s --report summary cluster
                                              Result

                                                FAQ

                                                How to pronounce the name "Trivy"?

                                              tri is pronounced like trigger, vy is pronounced like envy.

                                                Want more? Check out Aqua

                                              If you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering.
                                              You can find a high level comparison table specific to Trivy users here. In addition check out the https://aquasec.com website for more information about our products and services. If you'd like to contact Aqua or request a demo, please use this form: https://www.aquasec.com/demo

                                                Community

                                              Trivy is an Aqua Security open source project.
                                              Learn about our open source work and portfolio here.
                                              Contact us about any matter by opening a GitHub Discussion here

                                              Please ensure to abide by our Code of Conduct during all interactions.

                                        About

                                        Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

                                          trivy.dev

                                        Topics

                                          containersdevsecopsdockergogolanghacktoberfestiacinfrastructure-as-codekubernetesmisconfigurationsecuritysecurity-toolsvulnerabilityvulnerability-detectionvulnerability-scanners

                                        Resources

                                          Readme
                                          Apache-2.0 license

                                        Code of conduct

                                          Code of conduct

                                        Contributing

                                          Contributing

                                        Security policy

                                          Security policy
                                          Activity
                                          Custom properties

                                        Stars

                                          37.3k stars

                                        Watchers

                                          219 watching

                                        Forks

                                          578 forks
                                          Report repository

                                        Releases

                                        Packages

                                        Used by

                                        Contributors

                                        Languages

    Footer

        © 2026 GitHub, Inc.

      Footer navigation

        * Terms
        * Privacy
        * Security
        * Status
        * Community
        * Docs
        * Contact
        * Manage cookies
        * Do not share my personal information
      You can’t perform that action at this time.