# Trivy

> Trivy is an open source security scanner that finds vulnerabilities, misconfigurations and secrets in container images, code and infrastructure files.

- Source: https://www.itwonderlab.com/trivy/
- Published: 2026-08-09
- Updated: 2026-08-09
- Author: Javier Ruiz Jiménez (https://www.javierruizjimenez.com/)
- Site: IT Wonder Lab (https://www.itwonderlab.com/)

---

**Trivy**, from Aqua Security, scans container images, file systems, Git repositories, Kubernetes and IaC files such as [Terraform](https://www.itwonderlab.com/terraform/) for known CVEs, insecure settings and leaked secrets.

### Key concepts

- **Image scan**: vulnerabilities in OS packages and libraries.
- **Config scan**: misconfigurations in Dockerfiles, Kubernetes and Terraform.
- Easy to run in a CI pipeline such as [GitHub Actions](https://www.itwonderlab.com/github-actions/).

### Learn it

See [Docker image security scanning](https://www.itwonderlab.com/docker-image-security-scanning/) and [Terraform security scanning](https://www.itwonderlab.com/terraform-security-scanning-tflint-checkov-trivy/).