{"id":13414504,"url":"https://github.com/aquasecurity/trivy","last_synced_at":"2026-10-18T21:00:19.646Z","repository":{"id":37240930,"uuid":"180687624","full_name":"aquasecurity/trivy","owner":"aquasecurity","description":"Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more","archived":false,"fork":false,"pushed_at":"2026-10-12T12:12:16.000Z","size":945064,"stargazers_count":38376,"open_issues_count":259,"forks_count":758,"subscribers_count":230,"default_branch":"main","last_synced_at":"2026-10-12T23:52:16.278Z","etag":null,"topics":["containers","devsecops","docker","go","golang","hacktoberfest","iac","infrastructure-as-code","kubernetes","misconfiguration","security","security-tools","vulnerability","vulnerability-detection","vulnerability-scanners"],"latest_commit_sha":null,"homepage":"https://trivy.dev","language":"Go","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/aquasecurity.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":"NOTICE","maintainers":null,"copyright":null,"agents":null,"claude":null,"gemini":null,"cursor":null,"copilot":null,"dco":null,"cla":null,"disclosure":null}},"created_at":"2019-04-11T01:01:07.000Z","updated_at":"2026-10-12T22:42:41.000Z","dependencies_parsed_at":"2026-08-12T14:16:56.462Z","dependency_job_id":"4d2fa783-1a8b-44e0-aede-cc99c804503e","html_url":"https://github.com/aquasecurity/trivy","commit_stats":{"total_commits":2838,"total_committers":402,"mean_commits":7.059701492537314,"dds":0.7618040873854828,"last_synced_commit":"b7b8cdc9e96abec35757295582f5deaa43bd3181"},"previous_names":[],"tags_count":189,"template":false,"template_full_name":null,"purl":"pkg:github/aquasecurity/trivy","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftrivy","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftrivy/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftrivy/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftrivy/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/aquasecurity","download_url":"https://codeload.github.com/aquasecurity/trivy/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/aquasecurity%2Ftrivy/sbom","scorecard":{"id":88077,"data":{"date":"2025-08-11","repo":{"name":"github.com/aquasecurity/trivy","commit":"d3cd101266eb7bf9b8ffe5899765efa7bd1abe30"},"scorecard":{"version":"v5.2.1-40-gf6ed084d","commit":"f6ed084d17c9236477efd66e5b258b9d4cc7b389"},"score":6,"checks":[{"name":"Security-Policy","score":4,"reason":"security policy file detected","details":["Info: security policy file detected: SECURITY.md:1","Warn: no linked content found","Info: Found disclosure, vulnerability, and/or timelines in security policy: SECURITY.md:1","Info: Found text in security policy: SECURITY.md:1"],"documentation":{"short":"Determines if the project has published a security policy.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#security-policy"}},{"name":"Dangerous-Workflow","score":10,"reason":"no dangerous workflow patterns detected","details":null,"documentation":{"short":"Determines if the project's GitHub Action workflows avoid dangerous patterns.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#dangerous-workflow"}},{"name":"Maintained","score":10,"reason":"30 commit(s) and 11 issue activity found in the last 90 days -- score normalized to 10","details":null,"documentation":{"short":"Determines if the project is \"actively maintained\".","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#maintained"}},{"name":"Code-Review","score":10,"reason":"all changesets reviewed","details":null,"documentation":{"short":"Determines if the project requires human code review before pull requests (aka merge requests) are merged.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#code-review"}},{"name":"CII-Best-Practices","score":0,"reason":"no effort to earn an OpenSSF best practices badge detected","details":null,"documentation":{"short":"Determines if the project has an OpenSSF (formerly CII) Best Practices Badge.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#cii-best-practices"}},{"name":"Token-Permissions","score":0,"reason":"detected GitHub workflow tokens with excessive permissions","details":["Info: jobLevel 'contents' permission set to 'read': .github/workflows/reusable-release.yaml:27","Warn: no topLevel permission defined: .github/workflows/auto-close-issue.yaml:1","Warn: no topLevel permission defined: .github/workflows/auto-ready-for-review.yaml:1","Warn: no topLevel permission defined: .github/workflows/auto-update-labels.yaml:1","Warn: no topLevel permission defined: .github/workflows/backport.yaml:1","Warn: no topLevel permission defined: .github/workflows/bypass-cla.yaml:1","Warn: no topLevel permission defined: .github/workflows/bypass-test.yaml:1","Warn: no topLevel permission defined: .github/workflows/cache-test-assets.yaml:1","Warn: no topLevel permission defined: .github/workflows/canary.yaml:1","Warn: no topLevel permission defined: .github/workflows/mkdocs-dev.yaml:1","Warn: no topLevel permission defined: .github/workflows/mkdocs-latest.yaml:1","Warn: no topLevel permission defined: .github/workflows/publish-chart.yaml:1","Warn: no topLevel permission defined: .github/workflows/release-please.yaml:1","Warn: no topLevel permission defined: .github/workflows/release-pr-check.yaml:1","Warn: no topLevel permission defined: .github/workflows/release.yaml:1","Warn: no topLevel permission defined: .github/workflows/reusable-release.yaml:1","Warn: no topLevel permission defined: .github/workflows/roadmap.yaml:1","Warn: no topLevel permission defined: .github/workflows/scan.yaml:1","Warn: no topLevel permission defined: .github/workflows/semantic-pr.yaml:1","Warn: no topLevel permission defined: .github/workflows/spdx-cron.yaml:1","Warn: no topLevel permission defined: .github/workflows/stale-issues.yaml:1","Warn: no topLevel permission defined: .github/workflows/test-docs.yaml:1","Warn: no topLevel permission defined: .github/workflows/test.yaml:1","Warn: no topLevel permission defined: .github/workflows/triage.yaml:1","Info: no jobLevel write permissions found"],"documentation":{"short":"Determines if the project's workflows follow the principle of least privilege.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#token-permissions"}},{"name":"License","score":10,"reason":"license file detected","details":["Info: project has a license file: LICENSE:0","Info: FSF or OSI recognized license: Apache License 2.0: LICENSE:0"],"documentation":{"short":"Determines if the project has defined a license.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#license"}},{"name":"Binary-Artifacts","score":10,"reason":"no binaries found in the repo","details":null,"documentation":{"short":"Determines if the project has generated executable (binary) artifacts in the source repository.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#binary-artifacts"}},{"name":"Fuzzing","score":0,"reason":"project is not fuzzed","details":["Warn: no fuzzer integrations found"],"documentation":{"short":"Determines if the project uses fuzzing.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#fuzzing"}},{"name":"Branch-Protection","score":8,"reason":"branch protection is not maximal on development and all release branches","details":["Info: 'allow deletion' disabled on branch 'main'","Info: 'force pushes' disabled on branch 'main'","Warn: required approving review count is 1 on branch 'main'","Warn: codeowners review is not required on branch 'main'","Info: status check found to merge onto on branch 'main'","Info: PRs are required in order to make changes on branch 'main'"],"documentation":{"short":"Determines if the default and release branches are protected with GitHub's branch protection settings.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#branch-protection"}},{"name":"Packaging","score":10,"reason":"packaging workflow detected","details":["Info: Project packages its releases by way of GitHub Actions.: .github/workflows/test.yaml:209"],"documentation":{"short":"Determines if the project is published as a package that others can easily download, install, easily update, and uninstall.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#packaging"}},{"name":"Pinned-Dependencies","score":3,"reason":"dependency not pinned by hash detected -- score normalized to 3","details":["Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/auto-close-issue.yaml:12: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/auto-close-issue.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/auto-update-labels.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/auto-update-labels.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/auto-update-labels.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/auto-update-labels.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/backport.yaml:39: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/backport.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-test-assets.yaml:18: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/cache-test-assets.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-test-assets.yaml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/cache-test-assets.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-test-assets.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/cache-test-assets.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-test-assets.yaml:51: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/cache-test-assets.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-test-assets.yaml:54: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/cache-test-assets.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-test-assets.yaml:71: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/cache-test-assets.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-test-assets.yaml:84: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/cache-test-assets.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/cache-test-assets.yaml:87: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/cache-test-assets.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/canary.yaml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/canary.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/canary.yaml:35: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/canary.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/canary.yaml:42: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/canary.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/canary.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/canary.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/canary.yaml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/canary.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/mkdocs-dev.yaml:15: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/mkdocs-dev.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/mkdocs-dev.yaml:19: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/mkdocs-dev.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/mkdocs-latest.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/mkdocs-latest.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/mkdocs-latest.yaml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/mkdocs-latest.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-chart.yaml:28: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/publish-chart.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-chart.yaml:36: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/publish-chart.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/publish-chart.yaml:64: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/publish-chart.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/release-please.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/release-please.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yaml:59: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/release-please.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yaml:73: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/release-please.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release-please.yaml:101: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/release-please.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:27: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/release.yaml:75: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:33: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:37: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:43: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:49: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:56: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:63: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:68: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:91: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/reusable-release.yaml:122: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/reusable-release.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/roadmap.yaml:14: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/roadmap.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/roadmap.yaml:21: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/roadmap.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/roadmap.yaml:31: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/roadmap.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/roadmap.yaml:38: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/roadmap.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/roadmap.yaml:48: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/roadmap.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/roadmap.yaml:55: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/roadmap.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/roadmap.yaml:65: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/roadmap.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/roadmap.yaml:72: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/roadmap.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/scan.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/scan.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/scan.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/scan.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spdx-cron.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/spdx-cron.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/spdx-cron.yaml:16: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/spdx-cron.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/stale-issues.yaml:10: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/stale-issues.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-docs.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test-docs.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test-docs.yaml:17: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test-docs.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:195: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:198: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:219: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:222: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: third-party GitHubAction not pinned by hash: .github/workflows/test.yaml:240: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:22: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:25: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:74: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:77: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:94: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:107: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:110: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:126: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:129: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:146: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:161: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:164: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/test.yaml:181: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/test.yaml/main?enable=pin","Warn: GitHub-owned GitHubAction not pinned by hash: .github/workflows/triage.yaml:13: update your workflow using https://app.stepsecurity.io/secureworkflow/aquasecurity/trivy/triage.yaml/main?enable=pin","Warn: containerImage not pinned by hash: Dockerfile:1: pin your Docker image by updating alpine:3.22.1 to alpine:3.22.1@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1","Warn: containerImage not pinned by hash: Dockerfile.canary:1: pin your Docker image by updating alpine:3.22.1 to alpine:3.22.1@sha256:4bcff63911fcb4448bd4fdacec207030997caf25e9bea4045fa6c8c44de311d1","Warn: containerImage not pinned by hash: docs/build/Dockerfile:1: pin your Docker image by updating squidfunk/mkdocs-material:9.5.44 to squidfunk/mkdocs-material:9.5.44@sha256:ce587cbffd5283056df4a84bd3f2eb0c54f0031b1789844dcaf6ac53da0fd52c","Warn: containerImage not pinned by hash: docs/docs/advanced/container/embed-in-dockerfile.md:9: pin your Docker image by updating alpine:3.7 to alpine:3.7@sha256:8421d9a84432575381bfabd248f1eb56f3aa21d9d7cd2511583c68c9b7511d10","Warn: containerImage not pinned by hash: docs/docs/advanced/container/embed-in-dockerfile.md:22","Warn: pipCommand not pinned by hash: docs/build/Dockerfile:6","Warn: downloadThenRun not pinned by hash: docs/docs/advanced/container/embed-in-dockerfile.md:11-13","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-dev.yaml:24","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-dev.yaml:25","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-dev.yaml:26","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-latest.yaml:26","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-latest.yaml:27","Warn: pipCommand not pinned by hash: .github/workflows/mkdocs-latest.yaml:28","Warn: npmCommand not pinned by hash: .github/workflows/release-please.yaml:33","Warn: pipCommand not pinned by hash: .github/workflows/test-docs.yaml:22","Warn: pipCommand not pinned by hash: .github/workflows/test-docs.yaml:23","Info:   1 out of  64 GitHub-owned GitHubAction dependencies pinned","Info:   8 out of  23 third-party GitHubAction dependencies pinned","Info:   0 out of   1 npmCommand dependencies pinned","Info:   0 out of   5 containerImage dependencies pinned","Info:   0 out of   9 pipCommand dependencies pinned","Info:   0 out of   1 downloadThenRun dependencies pinned","Info:  11 out of  11 goCommand dependencies pinned"],"documentation":{"short":"Determines if the project has declared and pinned the dependencies of its build process.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#pinned-dependencies"}},{"name":"Signed-Releases","score":8,"reason":"5 out of the last 5 releases have a total of 5 signed artifacts.","details":["Info: signed release artifact: trivy_0.65.0_checksums.txt.sig: https://github.com/aquasecurity/trivy/releases/tag/v0.65.0","Info: signed release artifact: trivy_0.64.1_checksums.txt.sig: https://github.com/aquasecurity/trivy/releases/tag/v0.64.1","Info: signed release artifact: trivy_0.64.0_checksums.txt.sig: https://github.com/aquasecurity/trivy/releases/tag/v0.64.0","Info: signed release artifact: trivy_0.63.0_checksums.txt.sig: https://github.com/aquasecurity/trivy/releases/tag/v0.63.0","Info: signed release artifact: trivy_0.62.1_checksums.txt.sig: https://github.com/aquasecurity/trivy/releases/tag/v0.62.1","Warn: release artifact v0.65.0 does not have provenance: https://api.github.com/repos/aquasecurity/trivy/releases/236472821","Warn: release artifact v0.64.1 does not have provenance: https://api.github.com/repos/aquasecurity/trivy/releases/229753562","Warn: release artifact v0.64.0 does not have provenance: https://api.github.com/repos/aquasecurity/trivy/releases/229037344","Warn: release artifact v0.63.0 does not have provenance: https://api.github.com/repos/aquasecurity/trivy/releases/221903811","Warn: release artifact v0.62.1 does not have provenance: https://api.github.com/repos/aquasecurity/trivy/releases/216854674"],"documentation":{"short":"Determines if the project cryptographically signs release artifacts.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#signed-releases"}},{"name":"SAST","score":0,"reason":"SAST tool is not run on all commits -- score normalized to 0","details":["Warn: 0 commits out of 30 are checked with a SAST tool"],"documentation":{"short":"Determines if the project uses static code analysis.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#sast"}},{"name":"Vulnerabilities","score":0,"reason":"324 existing vulnerabilities detected","details":["Warn: Project is vulnerable to: GHSA-cpwx-vrp4-4pq7","Warn: Project is vulnerable to: GHSA-gmj6-6f8f-6699","Warn: Project is vulnerable to: GHSA-q2x7-8rv6-6q7h","Warn: Project is vulnerable to: GHSA-9hjg-9r4m-mvj7","Warn: Project is vulnerable to: GHSA-48p4-8xcf-vxj5","Warn: Project is vulnerable to: GHSA-pq67-6m6q-mj2v","Warn: Project is vulnerable to: GO-2022-0635","Warn: Project is vulnerable to: GO-2022-0646","Warn: Project is vulnerable to: GO-2025-3829 / GHSA-4vq8-7jfc-9cvp","Warn: Project is vulnerable to: GO-2025-3770 / GHSA-vrw8-fxc6-2r93","Warn: Project is vulnerable to: GHSA-25mq-v84q-4j7r","Warn: Project is vulnerable to: GHSA-q559-8m2m-g699","Warn: Project is vulnerable to: GHSA-q7rv-6hp3-vh96","Warn: Project is vulnerable to: GHSA-wxmh-65f7-jcvw","Warn: Project is vulnerable to: GO-2022-0379 / GHSA-qq97-vm5h-rrhg","Warn: Project is vulnerable to: GHSA-hqxw-f8mx-cpmw","Warn: Project is vulnerable to: GO-2022-0390 / GHSA-2mm7-x5h6-5pvq","Warn: Project is vulnerable to: GO-2022-0985 / GHSA-rc4r-wh2q-q6c4","Warn: Project is vulnerable to: GO-2022-1107 / GHSA-vp35-85q5-9f25","Warn: Project is vulnerable to: GO-2023-1699 / GHSA-232p-vwff-86mp","Warn: Project is vulnerable to: GO-2023-1700 / GHSA-33pg-m6jh-5237","Warn: Project is vulnerable to: GO-2023-1701 / GHSA-6wrf-mxfj-pf5p","Warn: Project is vulnerable to: GHSA-jq35-85cj-fj4p","Warn: Project is vulnerable to: GHSA-mq39-4gv4-mvpx","Warn: Project is vulnerable to: GO-2024-3005 / GHSA-v23v-6jw2-98fq","Warn: Project is vulnerable to: GO-2024-2512 / GHSA-xw73-rw38-6vjc","Warn: Project is vulnerable to: GO-2022-0316 / GHSA-hcw3-j74m-qc58","Warn: Project is vulnerable to: GO-2022-0587 / GHSA-x7f3-62pm-9p38","Warn: Project is vulnerable to: GO-2022-0574 / GHSA-2m4x-4q9j-w97g","Warn: Project is vulnerable to: GO-2024-3141 / GHSA-c77r-fh37-x2px","Warn: Project is vulnerable to: GO-2025-3660 / GHSA-6m8w-jc87-6cr7","Warn: Project is vulnerable to: GO-2021-0227 / GHSA-3vm4-22fp-5rfm","Warn: Project is vulnerable to: GO-2022-0968 / GHSA-gwc9-m7rh-j2ww","Warn: Project is vulnerable to: GO-2021-0356 / GHSA-8c26-wmh5-6g9v","Warn: Project is vulnerable to: GO-2024-2961","Warn: Project is vulnerable to: GO-2023-2402 / GHSA-45x7-px36-x8w8","Warn: Project is vulnerable to: GO-2024-3321 / GHSA-v778-237x-gjrc","Warn: Project is vulnerable to: GO-2025-3487 / GHSA-hcg3-q754-cr77","Warn: Project is vulnerable to: GO-2022-0288","Warn: Project is vulnerable to: GO-2022-0969 / GHSA-69cg-p879-7622","Warn: Project is vulnerable to: GO-2022-1144 / GHSA-xrjj-mj9h-534m","Warn: Project is vulnerable to: GO-2023-1571 / GHSA-vvpx-j8f3-3w6h","Warn: Project is vulnerable to: GO-2023-1988 / GHSA-2wrh-6pvc-2jm9","Warn: Project is vulnerable to: GO-2023-2102 / GHSA-4374-p667-p6c8","Warn: Project is vulnerable to: GO-2023-2153 / GHSA-m425-mq94-257g / GHSA-qppj-fm5r-hxr3","Warn: Project is vulnerable to: GO-2024-2687 / GHSA-4v7x-pqxf-cx7m","Warn: Project is vulnerable to: GO-2024-3333","Warn: Project is vulnerable to: GO-2025-3503 / GHSA-qxp5-gwg8-xv66","Warn: Project is vulnerable to: GO-2025-3595 / GHSA-vvgc-356p-c3xw","Warn: Project is vulnerable to: GO-2022-0493 / GHSA-p782-xgp4-8hr8","Warn: Project is vulnerable to: GO-2021-0113 / GHSA-ppp9-7jff-5vj2","Warn: Project is vulnerable to: GO-2022-1059 / GHSA-69ch-w2m2-3vjp","Warn: Project is vulnerable to: GO-2024-2611 / GHSA-8r3f-844c-mc37","Warn: Project is vulnerable to: GO-2022-0603 / GHSA-hp87-p4gw-j4gq","Warn: Project is vulnerable to: GHSA-27xj-rqx5-2255","Warn: Project is vulnerable to: GHSA-288c-cq4h-88gq","Warn: Project is vulnerable to: GHSA-4gq5-ch57-c2mg","Warn: Project is vulnerable to: GHSA-4w82-r329-3q67","Warn: Project is vulnerable to: GHSA-57j2-w4cx-62h2","Warn: Project is vulnerable to: GHSA-58pp-9c76-5625","Warn: Project is vulnerable to: GHSA-5949-rw7g-wx7w","Warn: Project is vulnerable to: GHSA-5p34-5m6p-p58g","Warn: Project is vulnerable to: GHSA-5r5r-6hpj-8gg9","Warn: Project is vulnerable to: GHSA-5ww9-j83m-q7qx","Warn: Project is vulnerable to: GHSA-645p-88qh-w398","Warn: Project is vulnerable to: GHSA-6fpp-rgj9-8rwc","Warn: Project is vulnerable to: GHSA-6wqp-v4v6-c87c","Warn: Project is vulnerable to: GHSA-758m-v56v-grj4","Warn: Project is vulnerable to: GHSA-85cw-hj65-qqv9","Warn: Project is vulnerable to: GHSA-89qr-369f-5m5x","Warn: Project is vulnerable to: GHSA-8c4j-34r4-xr8g","Warn: Project is vulnerable to: GHSA-8w26-6f25-cm9x","Warn: Project is vulnerable to: GHSA-95cm-88f5-f2c7","Warn: Project is vulnerable to: GHSA-9gph-22xh-8x98","Warn: Project is vulnerable to: GHSA-9m6f-7xcq-8vf8","Warn: Project is vulnerable to: GHSA-9mxf-g3x6-wv74","Warn: Project is vulnerable to: GHSA-9vvp-fxw6-jcxr","Warn: Project is vulnerable to: GHSA-c265-37vj-cwcc","Warn: Project is vulnerable to: GHSA-c2q3-4qrh-fm48","Warn: Project is vulnerable to: GHSA-c8hm-7hpq-7jhg","Warn: Project is vulnerable to: GHSA-cf6r-3wgc-h863","Warn: Project is vulnerable to: GHSA-cggj-fvv3-cqwv","Warn: Project is vulnerable to: GHSA-cjjf-94ff-43w7","Warn: Project is vulnerable to: GHSA-cmfg-87vq-g5g4","Warn: Project is vulnerable to: GHSA-cvm9-fjm9-3572","Warn: Project is vulnerable to: GHSA-f3j5-rmmp-3fc5","Warn: Project is vulnerable to: GHSA-f9hv-mg5h-xcw9","Warn: Project is vulnerable to: GHSA-f9xh-2qgp-cq57","Warn: Project is vulnerable to: GHSA-fmmc-742q-jg75","Warn: Project is vulnerable to: GHSA-fqwf-pjwf-7vqv","Warn: Project is vulnerable to: GHSA-gjmw-vf9h-g25v","Warn: Project is vulnerable to: GHSA-gwp4-hfv6-p7hw","Warn: Project is vulnerable to: GHSA-gww7-p5w4-wrfv","Warn: Project is vulnerable to: GHSA-h3cw-g4mq-c5x2","Warn: Project is vulnerable to: GHSA-h4rc-386g-6m85","Warn: Project is vulnerable to: GHSA-h592-38cm-4ggp","Warn: Project is vulnerable to: GHSA-h822-r4r5-v8jg","Warn: Project is vulnerable to: GHSA-j823-4qch-3rgm","Warn: Project is vulnerable to: GHSA-jjjh-jjxp-wpff","Warn: Project is vulnerable to: GHSA-m6x4-97wx-4q27","Warn: Project is vulnerable to: GHSA-mc6h-4qgp-37qh","Warn: Project is vulnerable to: GHSA-mph4-vhrx-mv67","Warn: Project is vulnerable to: GHSA-mx7p-6679-8g3q","Warn: Project is vulnerable to: GHSA-mx9v-gmh4-mgqw","Warn: Project is vulnerable to: GHSA-p43x-xfjf-5jhr","Warn: Project is vulnerable to: GHSA-q93h-jc49-78gg","Warn: Project is vulnerable to: GHSA-qjw2-hr98-qgfh","Warn: Project is vulnerable to: GHSA-qmqc-x3r4-6v39","Warn: Project is vulnerable to: GHSA-qr7j-h6gg-jmgc","Warn: Project is vulnerable to: GHSA-r3gr-cxrf-hg25","Warn: Project is vulnerable to: GHSA-r695-7vr9-jgc2","Warn: Project is vulnerable to: GHSA-rf6r-2c4q-2vwg","Warn: Project is vulnerable to: GHSA-rfx6-vp9g-rh7v","Warn: Project is vulnerable to: GHSA-rgv9-q543-rqg4","Warn: Project is vulnerable to: GHSA-rpr3-cw39-3pxh","Warn: Project is vulnerable to: GHSA-v3xw-c963-f5hc","Warn: Project is vulnerable to: GHSA-v585-23hc-c647","Warn: Project is vulnerable to: GHSA-vfqx-33qm-g869","Warn: Project is vulnerable to: GHSA-w3f4-3q6j-rh82","Warn: Project is vulnerable to: GHSA-wh8g-3j2c-rqj5","Warn: Project is vulnerable to: GHSA-x2w5-5m2g-7h5m","Warn: Project is vulnerable to: GHSA-p8f7-22gq-m7j9","Warn: Project is vulnerable to: GHSA-6c3j-c64m-qhgq","Warn: Project is vulnerable to: GHSA-gxr4-xjj5-5px2","Warn: Project is vulnerable to: GHSA-jpcq-cgw6-v4j6","Warn: Project is vulnerable to: GHSA-5crp-9r3c-p9vr","Warn: Project is vulnerable to: PYSEC-2023-62 / GHSA-m2qf-hxjv-5gpq","Warn: Project is vulnerable to: GHSA-h5c8-rqwp-cp95","Warn: Project is vulnerable to: GHSA-h75v-3vvj-5mfj","Warn: Project is vulnerable to: GHSA-2g68-c3qc-8985","Warn: Project is vulnerable to: PYSEC-2020-157 / GHSA-3p3h-qghp-hvh2","Warn: Project is vulnerable to: GHSA-f9vj-2wh5-fj8j","Warn: Project is vulnerable to: PYSEC-2019-140 / GHSA-gq9m-qvpx-68hc","Warn: Project is vulnerable to: PYSEC-2017-43 / GHSA-h2fp-xgx6-xh6f","Warn: Project is vulnerable to: PYSEC-2023-221 / GHSA-hrfv-mqp8-q5rw","Warn: Project is vulnerable to: GHSA-j544-7q9p-6xp8","Warn: Project is vulnerable to: PYSEC-2023-57 / GHSA-px8h-6qxv-m22q","Warn: Project is vulnerable to: GHSA-q34m-jh98-gwm2","Warn: Project is vulnerable to: PYSEC-2023-58 / GHSA-xg9f-g7g7-2323","Warn: Project is vulnerable to: PYSEC-2022-203","Warn: Project is vulnerable to: GHSA-fvqr-27wr-82fm","Warn: Project is vulnerable to: GHSA-4xc9-xhrj-v574","Warn: Project is vulnerable to: GHSA-x5rq-j2xg-h7qm","Warn: Project is vulnerable to: GHSA-jf85-cpcp-j695","Warn: Project is vulnerable to: GHSA-p6mc-m468-83gw","Warn: Project is vulnerable to: GHSA-29mw-wpgm-hmr9","Warn: Project is vulnerable to: GHSA-35jh-r3h4-6jhm","Warn: Project is vulnerable to: GHSA-h46c-h94j-95f3","Warn: Project is vulnerable to: GHSA-wf8f-6423-gfxg","Warn: Project is vulnerable to: GHSA-4rgh-jx4f-qfcq","Warn: Project is vulnerable to: RUSTSEC-2019-0001 / GHSA-5hp8-35wj-m525","Warn: Project is vulnerable to: RUSTSEC-2021-0074 / GHSA-5325-xw5m-phm3","Warn: Project is vulnerable to: RUSTSEC-2024-0421 / GHSA-h97m-ww89-6jmq","Warn: Project is vulnerable to: RUSTSEC-2016-0001 / GHSA-34p9-f4q3-c4r7","Warn: Project is vulnerable to: RUSTSEC-2023-0022","Warn: Project is vulnerable to: RUSTSEC-2023-0023","Warn: Project is vulnerable to: RUSTSEC-2023-0024","Warn: Project is vulnerable to: RUSTSEC-2023-0044","Warn: Project is vulnerable to: RUSTSEC-2023-0072","Warn: Project is vulnerable to: GHSA-q445-7m23-qrmw","Warn: Project is vulnerable to: RUSTSEC-2024-0357","Warn: Project is vulnerable to: RUSTSEC-2025-0004","Warn: Project is vulnerable to: RUSTSEC-2019-0035 / GHSA-mmc9-pwm7-qj5w","Warn: Project is vulnerable to: RUSTSEC-2023-0018 / GHSA-mc8h-8q98-g5hr","Warn: Project is vulnerable to: RUSTSEC-2019-0012 / GHSA-69gw-hgj3-45m7","Warn: Project is vulnerable to: RUSTSEC-2019-0009 / GHSA-mm7v-vpv8-xfc3","Warn: Project is vulnerable to: RUSTSEC-2018-0018 / GHSA-55m5-whcv-c49c / GHSA-66p5-j55p-32r9","Warn: Project is vulnerable to: RUSTSEC-2021-0003 / GHSA-43w2-9j62-hq99","Warn: Project is vulnerable to: RUSTSEC-2018-0017","Warn: Project is vulnerable to: PYSEC-2021-421 / GHSA-h4m5-qpfp-3mpv","Warn: Project is vulnerable to: PYSEC-2024-48 / GHSA-fj7x-q9j7-g6q6","Warn: Project is vulnerable to: PYSEC-2021-858 / GHSA-q4xr-rc97-m4xx","Warn: Project is vulnerable to: PYSEC-2022-42986 / GHSA-43fp-rhv2-5gv8","Warn: Project is vulnerable to: PYSEC-2023-135 / GHSA-xqr8-7jwr-rhp7","Warn: Project is vulnerable to: PYSEC-2019-17 / GHSA-337x-4q8g-prc5","Warn: Project is vulnerable to: PYSEC-2021-98 / GHSA-68w8-qjq3-2gfm","Warn: Project is vulnerable to: GHSA-7xr5-9hcq-chf9","Warn: Project is vulnerable to: GHSA-8x94-hmjh-97hq","Warn: Project is vulnerable to: GHSA-hmr4-m2h5-33qx","Warn: Project is vulnerable to: GHSA-rrqc-c2jx-6jgv","Warn: Project is vulnerable to: PYSEC-2019-16 / GHSA-vfq6-hq5r-27r6","Warn: Project is vulnerable to: PYSEC-2019-18 / GHSA-wh4h-v3f2-r2pp","Warn: Project is vulnerable to: PYSEC-2020-263 / GHSA-fx83-3ph3-9j2q","Warn: Project is vulnerable to: GHSA-gw84-84pc-xp82","Warn: Project is vulnerable to: PYSEC-2022-42973 / GHSA-q4qm-xhf9-4p8f","Warn: Project is vulnerable to: GHSA-hc5x-x2vx-497g","Warn: Project is vulnerable to: GHSA-w3h3-4rj7-4ph4","Warn: Project is vulnerable to: PYSEC-2021-16 / GHSA-93xj-8mrv-444m","Warn: Project is vulnerable to: PYSEC-2020-46 / GHSA-gg84-qgv9-w4pq","Warn: Project is vulnerable to: PYSEC-2024-60 / GHSA-jjg7-2v4v-x38h","Warn: Project is vulnerable to: PYSEC-2021-66 / GHSA-g3rq-g295-4j3m","Warn: Project is vulnerable to: PYSEC-2021-856 / GHSA-5545-2q6w-2gh6","Warn: Project is vulnerable to: GHSA-6p56-wp2h-9hxr","Warn: Project is vulnerable to: PYSEC-2021-857 / GHSA-f7c7-j99h-c22f","Warn: Project is vulnerable to: GHSA-fpfv-jqm9-f5jm","Warn: Project is vulnerable to: PYSEC-2020-73","Warn: Project is vulnerable to: PYSEC-2020-92 / GHSA-hj5v-574p-mj7c","Warn: Project is vulnerable to: PYSEC-2022-42969","Warn: Project is vulnerable to: PYSEC-2021-140 / GHSA-9w8r-397f-prfh","Warn: Project is vulnerable to: PYSEC-2023-117 / GHSA-mrwq-x4v8-fh7p","Warn: Project is vulnerable to: PYSEC-2021-141 / GHSA-pq64-v7f5-gqh8","Warn: Project is vulnerable to: PYSEC-2022-202 / GHSA-ffqj-6fqr-9h24","Warn: Project is vulnerable to: PYSEC-2020-176 / GHSA-3pqx-4fqf-j49f","Warn: Project is vulnerable to: PYSEC-2020-96 / GHSA-6757-jp84-gxfx","Warn: Project is vulnerable to: PYSEC-2021-142 / GHSA-8q59-q68h-6hv4","Warn: Project is vulnerable to: GHSA-9wx4-h78v-vm56","Warn: Project is vulnerable to: PYSEC-2023-74 / GHSA-j8r2-6x86-q33q","Warn: Project is vulnerable to: PYSEC-2022-43167","Warn: Project is vulnerable to: PYSEC-2023-206","Warn: Project is vulnerable to: GHSA-29pr-6jr8-q5jm","Warn: Project is vulnerable to: GHSA-g92j-qhmh-64v2","Warn: Project is vulnerable to: GHSA-2m57-hf25-phgg","Warn: Project is vulnerable to: PYSEC-2023-87 / GHSA-rrm6-wvj7-cwh2","Warn: Project is vulnerable to: GHSA-753j-mpmx-qq6g","Warn: Project is vulnerable to: GHSA-7cx3-6m66-7c5m","Warn: Project is vulnerable to: GHSA-8w49-h785-mj3c","Warn: Project is vulnerable to: PYSEC-2023-75 / GHSA-hj3f-6gcp-jg8j","Warn: Project is vulnerable to: GHSA-qppv-j76h-2rpx","Warn: Project is vulnerable to: GHSA-w235-7p84-xx57","Warn: Project is vulnerable to: GHSA-34jh-p97f-mpxf","Warn: Project is vulnerable to: PYSEC-2023-212 / GHSA-g4mx-q9vg-27p4","Warn: Project is vulnerable to: PYSEC-2023-207 / GHSA-gwvm-45gx-3cf8","Warn: Project is vulnerable to: PYSEC-2019-133 / GHSA-mh33-7rrq-662w","Warn: Project is vulnerable to: PYSEC-2019-132 / GHSA-r64q-w8jr-g9qp","Warn: Project is vulnerable to: PYSEC-2023-192 / GHSA-v845-jxx5-vc9f","Warn: Project is vulnerable to: PYSEC-2020-148 / GHSA-wqvq-5m8c-6g24","Warn: Project is vulnerable to: PYSEC-2021-108","Warn: Project is vulnerable to: PYSEC-2024-187 / GHSA-rqc4-2hc7-8c8v","Warn: Project is vulnerable to: GHSA-jfmj-5v4g-7637","Warn: Project is vulnerable to: GHSA-p9m8-27x8-rg87","Warn: Project is vulnerable to: GHSA-pfj3-56hm-jwq5","Warn: Project is vulnerable to: GHSA-j288-q9x7-2f5v","Warn: Project is vulnerable to: GHSA-v6w3-2prq-h95f","Warn: Project is vulnerable to: PYSEC-2019-217 / GHSA-462w-v97r-4m45","Warn: Project is vulnerable to: PYSEC-2014-8 / GHSA-8r7q-cvjq-x353","Warn: Project is vulnerable to: PYSEC-2014-82 / GHSA-fqh9-2qgg-h84h","Warn: Project is vulnerable to: PYSEC-2019-220 / GHSA-hj2j-77xm-mc5v","Warn: Project is vulnerable to: PYSEC-2014-5 / GHSA-296w-6qhq-gf92","Warn: Project is vulnerable to: PYSEC-2011-2 / GHSA-3jqw-crqj-w8qw","Warn: Project is vulnerable to: PYSEC-2012-3 / GHSA-59w8-4wm2-4xw8","Warn: Project is vulnerable to: PYSEC-2012-4 / GHSA-5h2q-4hrp-v9rr","Warn: Project is vulnerable to: PYSEC-2014-6 / GHSA-625g-gx8c-xcmg","Warn: Project is vulnerable to: PYSEC-2015-8 / GHSA-6565-fg86-6jcx","Warn: Project is vulnerable to: PYSEC-2012-2 / GHSA-78vx-ggch-wghm","Warn: Project is vulnerable to: PYSEC-2015-9 / GHSA-7fq8-4pv5-5w5c","Warn: Project is vulnerable to: PYSEC-2015-4 / GHSA-7qfw-j7hp-v45g","Warn: Project is vulnerable to: PYSEC-2011-9 / GHSA-7wph-fc4w-wqp2","Warn: Project is vulnerable to: PYSEC-2014-2 / GHSA-89hj-xfx5-7q66","Warn: Project is vulnerable to: PYSEC-2016-2 / GHSA-c8c8-9472-w52h","Warn: Project is vulnerable to: PYSEC-2016-3 / GHSA-crhm-qpjc-cm64","Warn: Project is vulnerable to: PYSEC-2014-4 / GHSA-f7cm-ccfp-3q4r","Warn: Project is vulnerable to: PYSEC-2016-16 / GHSA-fp6p-5xvw-m74f","Warn: Project is vulnerable to: PYSEC-2011-8 / GHSA-fwr5-q9rx-294f","Warn: Project is vulnerable to: PYSEC-2015-5 / GHSA-gv98-g628-m9x5","Warn: Project is vulnerable to: PYSEC-2015-20 / GHSA-h582-2pch-3xv3","Warn: Project is vulnerable to: PYSEC-2011-5 / GHSA-h95j-h2rv-qrg4","Warn: Project is vulnerable to: PYSEC-2015-6 / GHSA-jhjg-w2cp-5j44","Warn: Project is vulnerable to: PYSEC-2016-15 / GHSA-pw27-w7w4-9qc7","Warn: Project is vulnerable to: PYSEC-2015-10 / GHSA-q5qw-4364-5hhm","Warn: Project is vulnerable to: PYSEC-2011-4 / GHSA-rm2j-x595-q9cj","Warn: Project is vulnerable to: PYSEC-2014-1 / GHSA-rvq6-mrpv-m6rm","Warn: Project is vulnerable to: PYSEC-2014-7 / GHSA-rw75-m7gp-92m3","Warn: Project is vulnerable to: PYSEC-2014-3 / GHSA-wqjj-hx84-v449","Warn: Project is vulnerable to: PYSEC-2011-3 / GHSA-wxg3-mfph-qg9w","Warn: Project is vulnerable to: PYSEC-2011-1 / GHSA-x88j-93vc-wpmp","Warn: Project is vulnerable to: PYSEC-2007-1","Warn: Project is vulnerable to: PYSEC-2008-1","Warn: Project is vulnerable to: PYSEC-2008-2","Warn: Project is vulnerable to: PYSEC-2009-3","Warn: Project is vulnerable to: PYSEC-2015-11","Warn: Project is vulnerable to: PYSEC-2015-7","Warn: Project is vulnerable to: PYSEC-2016-18","Warn: Project is vulnerable to: PYSEC-2022-304","Warn: Project is vulnerable to: PYSEC-2018-34 / GHSA-2fc2-6r4j-p65h","Warn: Project is vulnerable to: PYSEC-2019-108 / GHSA-9fq2-x9r6-wfmf","Warn: Project is vulnerable to: PYSEC-2018-33 / GHSA-cw6w-4rcx-xphc","Warn: Project is vulnerable to: PYSEC-2017-1 / GHSA-frgw-fgh6-9g52","Warn: Project is vulnerable to: GO-2024-2947 / GHSA-v6v8-xj6m-xwqh","Warn: Project is vulnerable to: GHSA-269g-pwp5-87pp","Warn: Project is vulnerable to: GHSA-qwcr-r2fm-qrc7","Warn: Project is vulnerable to: GHSA-rv95-896h-c2vc","Warn: Project is vulnerable to: GHSA-qw6h-vgh9-j6wx","Warn: Project is vulnerable to: GHSA-c429-5p7v-vgjp","Warn: Project is vulnerable to: GHSA-mwcw-c2x4-8c55","Warn: Project is vulnerable to: GHSA-7fh5-64p2-3v2j","Warn: Project is vulnerable to: PYSEC-2024-230 / GHSA-248v-346w-9cwc","Warn: Project is vulnerable to: GHSA-vqfr-h8mv-ghfj","Warn: Project is vulnerable to: BIT-elasticsearch-2023-31417","Warn: Project is vulnerable to: BIT-elasticsearch-2023-46673","Warn: Project is vulnerable to: BIT-elasticsearch-2024-23449","Warn: Project is vulnerable to: BIT-elasticsearch-2023-49921","Warn: Project is vulnerable to: BIT-elasticsearch-2024-23444","Warn: Project is vulnerable to: BIT-elasticsearch-2024-23450","Warn: Project is vulnerable to: BIT-elasticsearch-2024-43709","Warn: Project is vulnerable to: BIT-elasticsearch-2024-52980","Warn: Project is vulnerable to: BIT-elasticsearch-2024-52981","Warn: Project is vulnerable to: BIT-elasticsearch-2024-52979","Warn: Project is vulnerable to: BIT-postgresql-2023-39417","Warn: Project is vulnerable to: BIT-postgresql-2023-39418","Warn: Project is vulnerable to: BIT-postgresql-2024-0985","Warn: Project is vulnerable to: BIT-postgresql-2023-5868","Warn: Project is vulnerable to: BIT-postgresql-2023-5869","Warn: Project is vulnerable to: BIT-postgresql-2023-5870","Warn: Project is vulnerable to: BIT-postgresql-2024-4317","Warn: Project is vulnerable to: BIT-postgresql-2024-7348","Warn: Project is vulnerable to: BIT-postgresql-2024-10976","Warn: Project is vulnerable to: BIT-postgresql-2024-10977","Warn: Project is vulnerable to: BIT-postgresql-2024-10978","Warn: Project is vulnerable to: BIT-postgresql-2024-10979","Warn: Project is vulnerable to: BIT-postgresql-2025-1094","Warn: Project is vulnerable to: BIT-postgresql-2025-4207","Warn: Project is vulnerable to: GHSA-4g8v-vg43-wpgf","Warn: Project is vulnerable to: GHSA-7wjx-3g7j-8584","Warn: Project is vulnerable to: GHSA-8727-m6gj-mc37","Warn: Project is vulnerable to: GHSA-8xww-x3g3-6jcv","Warn: Project is vulnerable to: GHSA-hjg4-8q5f-x6fm","Warn: Project is vulnerable to: GHSA-jp5v-5gx4-jmj9","Warn: Project is vulnerable to: GHSA-mm33-5vfq-3mm3","Warn: Project is vulnerable to: GHSA-p84v-45xj-wwqj","Warn: Project is vulnerable to: GHSA-vfg9-r3fq-jvx4","Warn: Project is vulnerable to: GHSA-vfm5-rmrh-j26v","Warn: Project is vulnerable to: GHSA-wh98-p28r-vrc9","Warn: Project is vulnerable to: GHSA-x76w-6vjr-8xgj","Warn: Project is vulnerable to: CVE-2025-26519"],"documentation":{"short":"Determines if the project has open, known unfixed vulnerabilities.","url":"https://github.com/ossf/scorecard/blob/f6ed084d17c9236477efd66e5b258b9d4cc7b389/docs/checks.md#vulnerabilities"}}]},"last_synced_at":"2025-08-15T07:20:53.462Z","repository_id":37240930,"created_at":"2025-08-15T07:20:53.462Z","updated_at":"2025-08-15T07:20:53.462Z"},"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":343843146,"owners_count":38257385,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-10-03T21:59:58.778Z","status":"online","status_checked_at":"2026-10-13T02:00:04.984Z","response_time":52,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["containers","devsecops","docker","go","golang","hacktoberfest","iac","infrastructure-as-code","kubernetes","misconfiguration","security","security-tools","vulnerability","vulnerability-detection","vulnerability-scanners"],"created_at":"2024-07-30T21:00:24.742Z","updated_at":"2026-10-18T21:00:14.608Z","avatar_url":"https://github.com/aquasecurity.png","language":"Go","funding_links":[],"categories":["Tools","Official resources","Go","Popular","Security Scanners","Container Operations","Security Testing","Docker","DevOps","DevSecOps","\u003ca id=\"683b645c2162a1fce5f24ac2abfa1973\"\u003e\u003c/a\u003e漏洞\u0026\u0026漏洞管理\u0026\u0026漏洞发现/挖掘\u0026\u0026漏洞开发\u0026\u0026漏洞利用\u0026\u0026Fuzzing","Container Tools","Kubernetes Security","一、核心工具集（按场景分类）","Container and Kubernetes Security","Repositories","Dependency intelligence","Security","CI/CD","\u003ca name=\"wazero\"\u003e\u003c/a\u003e[wazero](https://wazero.io) \u003csup\u003e[top⇈](#contents)\u003c/sup\u003e","Repositories / Tools","Other Awesome Lists","📡 Air-Gapped \u0026 Tactical Edge Deployment","Code Security","Go (531)","Static Application Security Testing","security-tools","Containers","📋 Table of Contents","蓝队工具","Infrastructure as Code","Image Lifecycle","security","Repos","Infrastructure as code security","vulnerability-scanners","[🔓 security](https://github.com/stars/ketsapiwiq/lists/unlock-security)","Инструменты","Security \u0026 Compliance","Application Recommendation","📊 At a glance","Official projects","golang","Platform Engineering","Across the Delivery Pipeline","Weapons","Container Scanning","Multiple languages","Network","🔐 Security \u0026 OSINT","docker","Security \u0026 Penetration Testing","0x02 工具 :hammer_and_wrench:","Security \u0026 DevSecOps","go","🚀 DevOps \u0026 Infrastructure","Secure Programming","Configuration Management","🔬 DFIR / Forensics","☸️ Kubernetes e Cloud Native","Tools \u0026 softwares","Container \u0026 Kubernetes","Open Source Projects","Dependency Automation","Software Composition Analysis (SCA)","容器管理与运维 (Container Operations)","Compliance Tools","🔐 Supply Chain \u0026 Runtime Security","工具：覆盖攻防全流程的实用利器","Tools \u0026 Platforms"],"sub_categories":["Kubernetes","Trivy","Security",".NET","Snippets Manager","Development","Service meshes","\u003ca id=\"c0bec2b143739028ff4ec439e077aa63\"\u003e\u003c/a\u003e漏洞扫描\u0026\u0026挖掘\u0026\u0026发现","Infrastructure as Code Analysis","MultiCloud Governance","Online resources","10. 安全与合规（防护风险）","Image Scanning","Vulnerability information exchange","Kubernetes Security","Defending","Containers","📦 Offline Model Weights \u0026 Package Mirrors","Software Composition Analysis (SCA)","Threat modelling","Open Source SCA Tools","IAC(Infrastructure-as-Code)扫描","Detection","Container Scanning","Datasource Integrations Blogs and Articles","Image Scanning \u0026 SBOM","Security Tools","Сканеры Docker образов","🔒 Cybersecurity","Repositories","Code Service","Build","Tools","Network Vulnerability Scanners","Business \u0026 Enterprise","2 云原生工具","SAST","Professional Security","Dependency / Container / Supply-Chain Scanning","Segurança K8s","Security assessment","CLI Audit Tools","安全 (Security)","IaC \u0026 Container Security Tools","Security Assessment","Image Distribution \u0026 Caching","2. 容器扫描（检测镜像/容器中的风险）","Open Source Platforms"],"readme":"\u003cdiv align=\"center\"\u003e\n\u003cimg src=\"docs/imgs/logo.png\" width=\"200\"\u003e\n\n[![GitHub Release][release-img]][release]\n[![Test][test-img]][test]\n[![Go Report Card][go-report-img]][go-report]\n[![License: Apache-2.0][license-img]][license]\n[![GitHub Downloads][github-downloads-img]][release]\n![Docker Pulls][docker-pulls]\n\n[📖 Documentation][docs]\n\u003c/div\u003e\n\nTrivy ([pronunciation][pronunciation]) is a comprehensive and versatile security scanner.\nTrivy has *scanners* that look for security issues, and *targets* where it can find those issues.\n\nTargets (what Trivy can scan):\n\n- Container Image\n- Filesystem\n- Git Repository (remote)\n- Virtual Machine Image\n- Kubernetes\n\nScanners (what Trivy can find there):\n\n- OS packages and software dependencies in use (SBOM)\n- Known vulnerabilities (CVEs)\n- IaC issues and misconfigurations\n- Sensitive information and secrets\n- Software licenses\n\nTrivy supports most popular programming languages, operating systems, and platforms. For a complete list, see the [Scanning Coverage] page.\n\nTo learn more, go to the [Trivy homepage][homepage] for feature highlights, or to the [Documentation site][docs] for detailed information.\n\n## Quick Start\n\n### Get Trivy\n\nTrivy is available in most common distribution channels. The full list of installation options is available in the [Installation] page. Here are a few popular examples:\n\n- `brew install trivy`\n- `docker run aquasec/trivy`\n- Download binary from \u003chttps://github.com/aquasecurity/trivy/releases/latest/\u003e\n- See [Installation] for more\n\nTrivy is integrated with many popular platforms and applications. The complete list of integrations is available in the [Ecosystem] page. Here are a few popular examples:\n\n- [GitHub Actions](https://github.com/aquasecurity/trivy-action)\n- [Kubernetes operator](https://github.com/aquasecurity/trivy-operator)\n- [VS Code plugin](https://github.com/aquasecurity/trivy-vscode-extension)\n- See [Ecosystem] for more\n\n### Canary builds\nThere are canary builds ([Docker Hub](https://hub.docker.com/r/aquasec/trivy/tags?page=1\u0026name=canary), [GitHub](https://github.com/aquasecurity/trivy/pkgs/container/trivy/75776514?tag=canary), [ECR](https://gallery.ecr.aws/aquasecurity/trivy#canary) images and [binaries](https://github.com/aquasecurity/trivy/actions/workflows/canary.yaml)) as generated every push to main branch.\n\nPlease be aware: canary builds might have critical bugs, it's not recommended for use in production.\n\n### General usage\n\n```bash\ntrivy \u003ctarget\u003e [--scanners \u003cscanner1,scanner2\u003e] \u003csubject\u003e\n```\n\nExamples:\n\n```bash\ntrivy image python:3.4-alpine\n```\n\n\u003cdetails\u003e\n\u003csummary\u003eResult\u003c/summary\u003e\n\nhttps://user-images.githubusercontent.com/1161307/171013513-95f18734-233d-45d3-aaf5-d6aec687db0e.mov\n\n\u003c/details\u003e\n\n```bash\ntrivy fs --scanners vuln,secret,misconfig myproject/\n```\n\n\u003cdetails\u003e\n\u003csummary\u003eResult\u003c/summary\u003e\n\nhttps://user-images.githubusercontent.com/1161307/171013917-b1f37810-f434-465c-b01a-22de036bd9b3.mov\n\n\u003c/details\u003e\n\n```bash\ntrivy k8s --report summary cluster\n```\n\n\u003cdetails\u003e\n\u003csummary\u003eResult\u003c/summary\u003e\n\n![k8s summary](docs/imgs/trivy-k8s.png)\n\n\u003c/details\u003e\n\n## FAQ\n\n### How to pronounce the name \"Trivy\"?\n\n`tri` is pronounced like **tri**gger, `vy` is pronounced like en**vy**.\n\n## Want more? Check out Aqua\n\nIf you liked Trivy, you will love Aqua which builds on top of Trivy to provide even more enhanced capabilities for a complete security management offering.  \nYou can find a high level comparison table specific to Trivy users [here](https://trivy.dev/latest/commercial/compare/).\nIn addition check out the \u003chttps://aquasec.com\u003e website for more information about our products and services.\nIf you'd like to contact Aqua or request a demo, please use this form: \u003chttps://www.aquasec.com/demo\u003e\n\n## Community\n\nTrivy is an [Aqua Security][aquasec] open source project.  \nLearn about our open source work and portfolio [here][oss].  \nContact us about any matter by opening a GitHub Discussion [here][discussions]\n\nPlease ensure to abide by our [Code of Conduct][code-of-conduct] during all interactions.\n\n[test]: https://github.com/aquasecurity/trivy/actions/workflows/test.yaml\n[test-img]: https://github.com/aquasecurity/trivy/actions/workflows/test.yaml/badge.svg\n[go-report]: https://goreportcard.com/report/github.com/aquasecurity/trivy\n[go-report-img]: https://goreportcard.com/badge/github.com/aquasecurity/trivy\n[release]: https://github.com/aquasecurity/trivy/releases\n[release-img]: https://img.shields.io/github/release/aquasecurity/trivy.svg?logo=github\n[github-downloads-img]: https://img.shields.io/github/downloads/aquasecurity/trivy/total?logo=github\n[docker-pulls]: https://img.shields.io/docker/pulls/aquasec/trivy?logo=docker\u0026label=docker%20pulls%20%2F%20trivy\n[license]: https://github.com/aquasecurity/trivy/blob/main/LICENSE\n[license-img]: https://img.shields.io/badge/License-Apache%202.0-blue.svg\n[homepage]: https://trivy.dev\n[docs]: https://trivy.dev/latest/docs/\n[pronunciation]: #how-to-pronounce-the-name-trivy\n[code-of-conduct]: https://github.com/aquasecurity/community/blob/main/CODE_OF_CONDUCT.md\n\n[Installation]:https://trivy.dev/latest/getting-started/installation/\n[Ecosystem]: https://trivy.dev/latest/ecosystem/\n[Scanning Coverage]: https://trivy.dev/latest/docs/coverage/\n\n[alpine]: https://ariadne.space/2021/06/08/the-vulnerability-remediation-lifecycle-of-alpine-containers/\n[rego]: https://www.openpolicyagent.org/docs/latest/#rego\n[sigstore]: https://www.sigstore.dev/\n\n[aquasec]: https://aquasec.com\n[oss]: https://www.aquasec.com/products/open-source-projects/\n[discussions]: https://github.com/aquasecurity/trivy/discussions\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faquasecurity%2Ftrivy","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Faquasecurity%2Ftrivy","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Faquasecurity%2Ftrivy/lists"}