Trivy

Container and IaC vulnerability scanner

FreeCode review, testing & securitytrivy.dev

What it is

Single-binary scanner covering container images, filesystems, git repositories, Kubernetes clusters and binary artifacts. It finds OS and language-package CVEs, misconfigurations in Terraform, Dockerfiles and Kubernetes manifests, and hardcoded secrets, and it can both generate and scan SBOMs. Available as CLI, GitHub Action, Kubernetes operator and VS Code extension.

Why it earns a slot

The Dockerfile your AI wrote almost certainly runs as root on a stale base image carrying dozens of known CVEs. One command in CI catches that plus any secret baked into an image layer.

Know before you commit

Default output lists every CVE including ones with no fix available. Use --ignore-unfixed and --severity HIGH,CRITICAL or the report is unreadable.

Getting started

brew install trivy && trivy image myapp:latest

Field notes

0 from the community

Loading notes…

Field check

Unverified

Pricing snapshot

$0 forever, Apache 2.0 open source, maintained by Aqua Security

Snapshots move fast — verify at checkout, and post a field note if it changed.

Drop into your Lovable chat

Evaluate Trivy (https://trivy.dev) for this project, then use it only if it fits what we are already building.
Context: Container and IaC vulnerability scanner. Single-binary scanner covering container images, filesystems, git repositories, Kubernetes clusters and binary artifacts. It finds OS and language-package CVEs, misconfigurations in Terraform, Dockerfiles and Kubernetes manifests, and hardcoded secrets, and it can both generate and scan SBOMs. Available as CLI, GitHub Action, Kubernetes operator and VS Code extension.
Reviewer notes (general, not written for this codebase): The Dockerfile your AI wrote almost certainly runs as root on a stale base image carrying dozens of known CVEs. One command in CI catches that plus any secret baked into an image layer.
Watch out for: Default output lists every CVE including ones with no fix available. Use --ignore-unfixed and --severity HIGH,CRITICAL or the report is unreadable.
Pricing: $0 forever, Apache 2.0 open source, maintained by Aqua Security
Setup: brew install trivy && trivy image myapp:latest
Rules: treat the notes above as background only. Do not assume a theme, style, layout or feature that is not already in this project — inspect the existing code first and ask me before changing visual direction.

/api/public/tools/trivy

Neighbourhood

How Trivy sits against the rest of the atlas — swaps, companions and the tools builders actually save alongside it.

Instead of thisDependabot Gitleaks Playwright Stagehand Storybook test runner Testing Library Vitest Aikido Security Arcjet Bito

Also in Code review, testing & security

Aikido Security

aikido.dev

All-in-one AppSec scanner

Free tier + paidCode review, testing & security

Developer free forever: 2 users, 10 repos, 2 container images, 1 domain, 250k protected requests/mo, 10 AI autofixes/mo; Basic $300/mo base for 10 users and 100 repos; Pro $600/mo for 200 repos; Advanced $600/mo for 500 repos; Enterprise custom

Open dossier

Arcjet

arcjet.com

In-app rate limiting and bot defence

PaidCode review, testing & security

No free plan as of 2026; Individual $25/app/mo; Startup $299/app/mo; Growth $799/app/mo; usage fees on top at $5 per 1M requests plus per-feature rates such as $0.50 per 1M for bot detection; 15-day trial

Open dossier

Bito

bito.ai

AI PR review agent

PaidCode review, testing & security

Team $12/seat/mo annually or $15 monthly; Professional $20/seat/mo annually or $25 monthly; both include 5,000 lines reviewed per seat per month, overage $5 per 1,000 lines; Enterprise custom; 14-day trial

Open dossier

Browserbase

browserbase.com

Hosted headless browser cloud

Free tier + paidCode review, testing & security

Free: 1 browser hour/mo; Developer $20/mo with 100 browser hours then $0.12/hr; Startup $99/mo with 500 hours then $0.10/hr; Scale custom with 250+ concurrent browsers

Open dossier