---
name: Trivy
slug: trivy
url: https://github.com/aquasecurity/trivy
category: Code scanning
bestFor: "Scan a project directory for known vulnerabilities, misconfigurations, and secrets."
freeTier: yes
price: "Apache-2.0"
checks:
  - secrets
freeTierNote: "The README badge says License: Apache-2.0 and calls Trivy an Aqua Security open source project. The same README lists scanners for OS packages and software dependencies, known vulnerabilities, IaC misconfigurations, secrets, and software licenses. Targets include a filesystem and a git repository. It points to Aqua as a commercial product and does not list Aqua's price."
verifiedOn: "2026-10-14"
sources:
  - https://github.com/aquasecurity/trivy
  - https://trivy.dev/docs/latest/
unknowns:
  - "A dollar price for Aqua, the commercial product named in the README."
  - "Which secret patterns or vulnerability databases the default filesystem scan uses. The README names the scanner types and links to the docs for coverage."
---

Trivy scans a target you point it at. The README's filesystem example is `trivy fs --scanners vuln,secret,misconfig` on a project directory. That looks at the tree on disk. It is not a login to your production site and it does not describe a Supabase row-level-security check.

The project is Apache-2.0. Aqua is a separate commercial product the README links to, without a price on that page. Install from the channels the README lists, such as Homebrew or the container image, and read the finding before you treat a CVE in a dev tool as an emergency.