$ man trivy

Trivy

Vulnerabilities and misconfigurations in images, dependencies and IaC.

fix at sourcepassive / local onlyvia awesome-security

## why a developer should care

Your base image ships hundreds of packages you never chose. Trivy shows which are vulnerable, scans lockfiles, and can produce an SBOM.

$ brew install trivy

Other platforms and pre-built binaries: official install guide ↗

Check it worked: open a new terminal and run trivy --version. "command not found" means it isn't installed or isn't on your PATH yet.

image:

# Scan project dependencies

$ trivy fs .

# Scan an image

$ trivy image {{target}}

# Fail CI on high/critical

$ trivy image --severity HIGH,CRITICAL --exit-code 1 {{target}}

# Generate an SBOM

$ trivy image --format cyclonedx -o sbom.json {{target}}