Commits code and manifests
DevOps & Tooling / Knowledge library
Trivy
vulnerability misconfiguration and secret scanning
Why learn Trivy?
Useful for adding security checks to development and delivery workflows. Findings require triage; a clean scan is not proof that software is secure.
Where it came from
Trivy scans supported artifacts and environments for security issues, including vulnerabilities, misconfigurations, and secrets. Scan coverage depends on target type and enabled scanners.
Build your understanding
Work through these exercises in order. Try the task before opening a reference.
- Scan a trusted test image.
- Inspect the affected package and advisory for a finding.
- Scan infrastructure configuration for misconfigurations.
- Configure a documented severity policy in a test pipeline.
- Track justified exceptions with owners and expiration dates.
Documentation and sources
- Official documentation (trivy.dev)
Catalog research notes
- Research snapshot: September 9, 2026. This entry summarizes the linked primary documentation; it does not assert a latest release version.
Connect the ideas
Explore next
Real World Example
Securing Cloud-Native Financial Microservices
A regional fintech firm managing high-frequency transaction microservices deployed on Kubernetes.
The business problem
The development team frequently commits hardcoded API credentials and misconfigured container manifests to the internal registry, leading to potential unauthorized access and compliance violations.
How this topic solves it
Trivy provides a unified scanner that integrates into the CI/CD pipeline to perform static analysis on container images and Infrastructure-as-Code files, identifying vulnerabilities, secret leaks, and misconfigurations before deployment.
- Integrate Trivy as a binary step within the CI pipeline runner.
- Configure Trivy to scan the local filesystem for IaC files like Kubernetes manifests.
- Define a severity threshold to fail builds containing High or Critical findings.
- Output results in JSON format for ingestion by the security dashboard.
This diagram illustrates the flow from code commit to deployment gate.
Automated build environment
Static analysis engine
Container image storage
Kubernetes Cluster
- Developer → triggers → CI Pipeline
- CI Pipeline → scans artifacts → Trivy Scanner
- Trivy Scanner → returns findings → CI Pipeline
- CI Pipeline → pushes if clean → Registry
- Registry → deploys → Deployment
Expected business outcome
The organization achieves a consistent security baseline where insecure configurations and exposed secrets are blocked automatically, reducing the manual audit burden on the security team.
Limitations and checks
Trivy performs static analysis, meaning it cannot detect runtime-only vulnerabilities or misconfigurations that emerge only after environmental variables are injected at execution time; verify this by comparing static scan results against runtime security monitoring logs.