Trivy Security Scanner

Trivy is an open-source security scanner. It checks container images, file systems, Git repositories and infrastructure-as-code for known vulnerabilities, misconfigurations and exposed secrets.

Run in CI, it catches vulnerable base images and dependencies before deployment and can produce a software bill of materials (SBOM). It works as a single binary, so it fits into existing pipelines without extra infrastructure.