Trivy (tri pronounced like trigger, vy pronounced like envy) is a comprehensive security scanner. It is reliable, fast, and straightforward to use and works wherever you need it.
Trivy has different scanners that look for security issues and targets where it can find those issues.
T
argets:
Container Image
Filesystem
Git repository (remote)
Kubernetes cluster or resource
Scanners:
OS packages and software dependencies in use (SBOM)
Known vulnerabilities (CVEs)
IaC misconfigurations
Sensitive information and secrets
Source code and additional information can be found here: https://github.com/aquasecurity/trivy