Trivy
Scan a project directory for known vulnerabilities, misconfigurations, and secrets.
Last updated
- Price
- Apache-2.0
- Free tier
- Yes
- Checks
- Secrets
- Last verified
- Oct 14, 2026
What the public pages say
Trivy scans a target you point it at. The README's filesystem example is trivy fs --scanners vuln,secret,misconfig on a project directory. That looks at the tree on disk. It is not a login to your production site and it does not describe a Supabase row-level-security check.
The project is Apache-2.0. Aqua is a separate commercial product the README links to, without a price on that page. Install from the channels the README lists, such as Homebrew or the container image, and read the finding before you treat a CVE in a dev tool as an emergency.
Free tier
The README badge says License: Apache-2.0 and calls Trivy an Aqua Security open source project. The same README lists scanners for OS packages and software dependencies, known vulnerabilities, IaC misconfigurations, secrets, and software licenses. Targets include a filesystem and a git repository. It points to Aqua as a commercial product and does not list Aqua's price.
Left off the vendor's site
- A dollar price for Aqua, the commercial product named in the README.
- Which secret patterns or vulnerability databases the default filesystem scan uses. The README names the scanner types and links to the docs for coverage.
Sources
Listed on ShipSecurely
Put this on Trivy's site. The image links back to this page.
<a href="https://shipsecurely.dev/tools/trivy"><img src="https://shipsecurely.dev/badge.svg" width="196" height="32" alt="Listed on ShipSecurely"></a>
Markdown version · Canonical page: https://shipsecurely.dev/tools/trivy