# Trivy

10 Hacker News commenters recommended Trivy and 23 criticized it, November 2025 to November 2026. It was recommended in 5 of 13 months.

**Verdict:** Open-source scanner that checks container images, code and configs for known vulnerabilities; people recommend it for automated security scanning, though its 2026 GitHub Actions compromises drew heavy criticism.

## Why people recommend it

- Scans container images for vulnerabilities (2 comments): "Tools like trivvy make it possible to do the scans" ([source](https://news.ycombinator.com/item?id=49154607)) "automated image scanning with Trivy" ([source](https://news.ycombinator.com/item?id=47295306))
- Seen as core security tooling (2 comments): "built in vulnerability and configuration scanning so you don't get pwned by Trivy" ([source](https://news.ycombinator.com/item?id=47973459)) "tools like trivy and sempreg are basically the backbone of every safe program" ([source](https://news.ycombinator.com/item?id=48049946))

## What people warn about

- Repeated supply chain compromises (7 comments): "it was a direct attack on Trivy, exploiting components that Aqua had full control and responsibility for" ([source](https://news.ycombinator.com/item?id=47475508)) "the fault was within the side of ironically a security product that they used called Trivy" ([source](https://news.ycombinator.com/item?id=48799413)) "Any system with Trivy 0.69.4 on it (and being run) can be assumed to be compromised." ([source](https://news.ycombinator.com/item?id=47449542))
- Slow or incomplete incident response (5 comments): "they are going to continue to fail to protect their own artifacts and distribution chains" ([source](https://news.ycombinator.com/item?id=47473116)) "they're clearly not capable of handling this and should be enlisting outside help" ([source](https://news.ycombinator.com/item?id=47492825)) "the first rotation didn't fully revoke access. the attacker walked right back in" ([source](https://news.ycombinator.com/item?id=47493539))
- Unpinned and mutable dependencies (2 comments): "the action itself can still make mutable decisions (like pulling the “latest” version of a binary from somewhere on the internet)" ([source](https://news.ycombinator.com/item?id=47474324)) "even pinned actions themselves download unpinned transitive dependencies" ([source](https://news.ycombinator.com/item?id=47966268))

## Alternatives hackers recommend

- [OpenAI Codex Security](https://hackerapproved.com/p/codex-security.md): 21 recommend
- [govulncheck](https://hackerapproved.com/p/govulncheck.md): 13 recommend
- [cargo-vet](https://hackerapproved.com/p/cargo-vet.md): 8 recommend
- [cargo-audit](https://hackerapproved.com/p/cargo-audit.md): 8 recommend
- [Aikido Safe-Chain](https://hackerapproved.com/p/aikido-safe-chain.md): 7 recommend

## Cite as

Hacker Approved, "Trivy", https://hackerapproved.com/p/trivy/ (counts from 1,795,640 Hacker News comments, November 2025 to November 2026).