aquasecurity/trivy
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
Build with Backblaze B2
SDKs, agent skills, IDE extensions, and reference pipelines from Backblaze Labs. All open source.
Loading star history...
Where it stands
Rank, growth pace and release cadence relative to everything GStars tracks.
Ranks #41 of 3,103 repositories GStars tracks this week (top 1%).
5 releases in the last 90 days, the latest 2 days ago, with 442 contributors on GitHub.
Peaked at #14 in the weekly ranking the week of Feb 1, its best in the past year.
Use Cases & Benefits
- Trivy is a versatile security scanner for containers, Kubernetes, code repos, clouds, detecting vulnerabilities, misconfigurations, secrets, and SBOMs.
- Built in Go, it supports scanning container images, filesystems, git repos, VM images, and Kubernetes with multiple scanners for CVEs, IaC issues, secrets, and licenses.
- Strengths include broad target and scanner support, active maintenance since 2019, Apache-2.0 license, and integration with popular platforms like GitHub Actions and Kubernetes.
- High popularity is indicated by 28k+ stars, 2.6k forks, frequent updates, and wide adoption in DevSecOps and container security communities.
- Ideal for DevSecOps teams needing comprehensive vulnerability and misconfiguration detection across containerized and cloud-native environments.
Should you depend on it?
License terms, project hygiene and risks, from GitHub metadata and GStars' snapshots.
License
Apache 2.0
Permissive: commercial use, modification and redistribution are allowed with attribution; includes an explicit patent grant from contributors.
Community files
- README: present
- Contributing guide: present
- Code of conduct: present
Watch-outs
No watch-outs from GStars' checks.
General guidance from repository metadata, not legal advice. How we score
From the README
Trivy (pronunciation) is a comprehensive and versatile security scanner. Trivy has scanners that look for security issues, and targets where it can find those issues.
Trivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the Scanning Coverage page.
To learn more, go to the Trivy homepage for feature highlights, or to the Documentation site for detailed information.
Daily snapshots
Stars gained per day, and how forks and open issues moved, from GStars' daily snapshots
+1,589 stars over 90 days across 49 snapshot days; best day +44 on Oct 24.
Forks
794+241
Open issues
277+43
Compared with peers in Security
Fastest-growing repositories GStars tracks in this cohort for the week of Oct 18, by 7-day star growth
| Repository | Stars | +7d | Health | Last release |
|---|---|---|---|---|
| cloudflare/security-audit-skill | 42.2K | +11.2K | 75 | — |
| vxcontrol/pentagi | 32.2K | +1.5K | 75 | 18 days ago |
| Asymptote-Labs/agent-beacon | 2.7K | +856 | 60 | 1 day ago |
| martin-olivier/airgorah | 4.7K | +531 | 75 | 27 days ago |
| caddyserver/caddy | 78.3K | +272 | 75 | 20 days ago |
| aquasecurity/trivy | 38.7K | +0 | 75 | 2 days ago |
| Category median | 32.2K | +856 | 75 | — |
Discover Repositories
Search across tracked repositories by name or description