{
  "slug": "trivy",
  "name": "Trivy",
  "url": "https://trivy.dev",
  "cat": "review",
  "group": "ship",
  "tagline": "Container and IaC vulnerability scanner",
  "price": "$0 forever, Apache 2.0 open source, maintained by Aqua Security",
  "tier": "free",
  "pick": false,
  "what": "Single-binary scanner covering container images, filesystems, git repositories, Kubernetes clusters and binary artifacts. It finds OS and language-package CVEs, misconfigurations in Terraform, Dockerfiles and Kubernetes manifests, and hardcoded secrets, and it can both generate and scan SBOMs. Available as CLI, GitHub Action, Kubernetes operator and VS Code extension.",
  "why": "The Dockerfile your AI wrote almost certainly runs as root on a stale base image carrying dozens of known CVEs. One command in CI catches that plus any secret baked into an image layer.",
  "warn": "Default output lists every CVE including ones with no fix available. Use <code>--ignore-unfixed</code> and <code>--severity HIGH,CRITICAL</code> or the report is unreadable.",
  "install": "brew install trivy && trivy image myapp:latest",
  "category": {
    "key": "review",
    "name": "Code review, testing & security",
    "desc": "The single biggest risk in vibe coding is shipping AI code nobody read. This is the fix.",
    "group": "ship",
    "groupName": "Ship it & keep it alive"
  },
  "freshness": null,
  "health": {
    "ok": true,
    "status_code": 200,
    "final_url": "https://trivy.dev/",
    "checked_at": "2026-08-19T00:37:41.862+00:00"
  },
  "corrected_at": null,
  "upstream_changed_at": null
}