trivy
Safeguard articles tagged "trivy" — guides, analysis, and best practices for software supply chain and application security.
38 articles
Docker Vulnerability Scanners: What They Catch and Miss
Image scanners are excellent at matching OS packages and language dependencies against CVE databases — and structurally blind to config flaws, runtime behavior, and code you compiled yourself. Where the line sits.
Trivy v0.69 Release Deep Dive
Aqua's Trivy hit v0.69 in late 2025 with VEX-by-default scanning, ArtifactID/ReportID provenance fields, and faster misconfig scanning. We test the upgrade on a 1.2GB image.
Automating container image vulnerability scans in GitHub Actions
A fail-the-build scanning pipeline is a few YAML lines away — but pin the Action wrong and you inherit its supply chain risk too.
Trivy vs Snyk: A Practical Comparison for Real Pipelines
Trivy vs Snyk is really open-source scanner versus commercial platform. Here is where each wins, where they overlap, and why many teams run both.
Running Trivy on GitHub: A Practical Security Guide
Wiring Trivy into GitHub Actions gives you free container, filesystem, and IaC scanning with results in the Security tab. Here's a working setup and the pinning mistake to avoid.
Docker Image Security Scan: How to Scan Images for Vulnerabilities
A Docker image security scan inspects the layers of an image for known-vulnerable packages before you ship it. Here are the tools, commands, and the workflow that keeps scanning useful.
Safeguard vs Trivy: vulnerability scanning depth and reme...
Trivy scans fast and free, but leaves remediation to you. See how Safeguard's platform handles cross-repo correlation, prioritization, and audit-ready fix tracking.
CNAPP vs CSPM: what's the difference
CSPM checks cloud configs, CNAPP consolidates workload security -- neither verifies what's inside your software. Safeguard vs Trivy (Aqua), compared.
OSS container image scanning tools compared
Trivy finds CVEs fast and free. Safeguard compares how each handles fleet-wide inventory, triage, policy enforcement, and audit evidence at scale.
Best SBOM tools compared (including Trivy)
Trivy generates SBOMs fast at scan time. Safeguard turns those SBOMs into a versioned, queryable inventory you can match against new CVEs org-wide.
GitHub secret scanning vs dedicated scanning tools
GitHub secret scanning vs Trivy: how push protection, validity checks, and multi-source coverage differ, and where Safeguard fits for cross-repo remediation.
Why static scanning misses runtime threats (the case for ...
Trivy's build-time CVE scans miss fileless malware, reverse shells, and live threats. Here's how ATT&CK-mapped runtime protection closes the gap.
Self-healing security runs on Safeguard.
Your first fix PR is minutes away.
No sales call required, even your agent can complete the purchase over MCP.