Trivy
Open-source vulnerability scanner by Aqua Security for containers, Kubernetes, infrastructure-as-code, filesystems, and dependencies — CVEs, misconfigurations, secrets, and license issues in one binary.
Use Cases
Free Tier
100% free and open-source (Apache 2.0) — no usage limits, no account, runs locally and in CI
How to Maximize the Free Tier
Trivy is completely free with no feature gating or usage caps — the only cost is your time maintaining it. Run `trivy image <name>` to scan containers, `trivy fs .` for repository dependencies, and `trivy config` for Terraform/Kubernetes misconfigurations. Wire it into CI with the official trivy-action (GitHub Actions) or a GitLab job and export SARIF to see findings in GitHub code scanning. Keep the vulnerability database updated (refresh the image or run with the latest DB) or scans go stale. It complements Semgrep (code-level SAST) and Gitleaks (secrets) nicely — Trivy covers the container and supply-chain angle for free.
Getting Started
Install Trivy (`brew install trivy` or download a binary from GitHub releases) → run `trivy image <image-name>` to scan a container → run `trivy fs .` in your repo for dependency CVEs → add trivy-action to GitHub Actions for automated PR scanning → export JSON/SARIF/HTML reports.
Pros
- Truly free: Apache 2.0 open source with no premium tiers, feature gating, or usage caps
- Broad coverage: Scans containers, Kubernetes, IaC, filesystems, dependencies, secrets, and licenses in one binary
- CI-native: Official GitHub Action, GitLab CI support, and SARIF output for GitHub code scanning
Cons
- Self-managed: No hosted dashboard or alerting — you integrate it into CI and reporting yourself
- No remediation tracking: Flags vulnerabilities but doesn't track fixes or provide a fix workflow
- Manual updates: The vulnerability database must be refreshed regularly or results go stale