Trivy

Apache-2.0 all-in-one vuln/IaC/secret/SBOM scanner; no paid tier

DevOps / Security · Apache-2.0 · 38.6k

Reviewed 2026-09-04 · last push 2026-10-20 · repo checked 2026-10-21

What's Good

Apache-2.0. CVE vuln scan, misconfig, secrets, licenses, SBOM. Targets: containers, filesystems, git, Terraform/CloudFormation/Dockerfiles, Kubernetes. Default scanner in GitLab/Harbor/Artifact Hub. No feature gate on the CLI.

The Catch

CLI/CI scanner — not Aqua Platform management UI/RBAC/policy SaaS. Vs Grype/Snyk: Aqua OSS default with broad target surface; Aqua Inc monetizes a separate commercial platform. You still triage and patch.

Verdict

Apache-2.0 security scanner. Fully free CLI; Aqua Platform is the paid cousin.

Embed

Maintainer? Add the badge to your README. It is free, links to this review, and there is no paid version.

Markdown

[![Reviewed on Stack Gems](https://stackgems.com/badge/trivy.svg)](https://stackgems.com/gems/trivy)

HTML

<a href="https://stackgems.com/gems/trivy"><img src="https://stackgems.com/badge/trivy.svg" alt="Trivy reviewed on Stack Gems" height="20"></a>

DevOps →

Related