Trivy
Metrics as of , from the GitHub or GitLab API of each repository. Refreshed monthly.
What Trivy is
Trivy is a security scanner organised around targets and scanners. Its documented targets are container images, filesystems, remote Git repositories, virtual machine images and Kubernetes. Its scanners detect OS packages and software dependencies (SBOM), known CVEs, IaC misconfigurations, secrets and software licenses. It runs from the command line as trivy followed by a target type, with an optional --scanners flag. README examples scan a container image, a project directory and a Kubernetes cluster. Distribution channels include Homebrew, Docker images and release binaries. Listed integrations include GitHub Actions, a Kubernetes operator and a VS Code plugin. Trivy is an open source project from Aqua Security.
Written from the project's README, read .
- Category
- Security testing
- License
- Apache-2.0
- Language
- Go
- Changelog
- Releases on GitHub
Repository metrics
Status
activeLast commit within 90 days of the fetch date.Computed from the last commit date and the archive flag on the fetch date. See the status rules.
Alternatives
Listed security testing tools, same primary language first, then by GitHub stars. Each line gives one fact from the tool's documentation where it differs from Trivy's, with its source. See also Trivy alternatives.
Nuclei: Scan targets: Target URLs and hosts, from a single target or a list file. source: README
Gitleaks: Scan targets: Secrets such as passwords, API keys and tokens in git repositories, files and stdin. source: README
ffuf: Scan targets: Web servers: content paths, virtual hosts, GET parameters and POST data. source: README
OSV-Scanner: Scan targets: Project dependencies, checked against the OSV database. source: README
sqlmap: Scan targets: Web application parameters: GET, POST, cookie, User-Agent and Referer values. source: Docs: Features
Promptfoo: Scan targets: LLM apps, through red teaming and vulnerability scanning. source: README
ZAP: Scan targets: Web applications. source: README
Nikto: Scan targets: Web servers: potentially dangerous files or programs, outdated server components. source: Docs: Overview & Description
Comparisons
How to install
brew install trivyQuestions
Is Trivy open source?
Yes. Trivy is released under Apache-2.0, an OSI-approved license, as reported by the GitHub API on 2026-09-22.
Is Trivy maintained?
On 2026-09-22, the last commit to the default branch was on 2026-09-22, so the listed status is active. Rule: Last commit within 90 days of the fetch date.
How many GitHub stars does Trivy have?
38,009 stars on 2026-09-22, from the GitHub API. The number is refreshed at each monthly update.
What language is Trivy written in?
The repository's primary language, as reported by the GitHub API, is Go.
How do I install Trivy?
The README gives this command: brew install trivy
Sources
- GitHub REST API: repository, read
- GitHub REST API: commits, read
- GitHub REST API: latest release, read
- GitHub REST API: contributors, read
- README, read