Trivy Scanner for Container Security in Java

Trivy is a comprehensive and versatile security scanner that detects vulnerabilities in container images, file systems, Git repositories, and more. Integrating Trivy into Java applications enables automated security scanning in CI/CD pipelines and runtime environments.

Trivy Overview and Integration Patterns

Understanding Trivy Components

// Trivy scan result models public class TrivyScanResult { private String target; private List<Vulnerability> vulnerabilities; private List<Misconfiguration> misconfigurations; private List<Secret> secrets; private Date scanDate; // constructors, getters, setters public TrivyScanResult(String target) { this.target = target; this.vulnerabilities = new ArrayList<>(); this.misconfigurations = new ArrayList<>(); this.secrets = new ArrayList<>(); this.scanDate = new Date(); } } public class Vulnerability { private String vulnerabilityID; private String pkgName; private String installedVersion; private String fixedVersion; private String severity; private String title; private String description; private List<String> references; // constructors, getters, setters } public class Misconfiguration { private String type; private String id; private String title; private String description; private String severity; private String resolution; // constructors, getters, setters } public class Secret { private String category; private String severity; private String title; private String match; private int startLine; private int endLine; // constructors, getters, setters }

Java Integration with Trivy

Method 1: Command Line Execution

@Component public class TrivyCommandLineScanner { private static final Logger logger = LoggerFactory.getLogger(TrivyCommandLineScanner.class); private final String trivyBinaryPath; private final String cacheDir; private final String outputFormat; public TrivyCommandLineScanner(@Value("${trivy.binary.path:/usr/local/bin/trivy}") String trivyBinaryPath, @Value("${trivy.cache.dir:/tmp/trivy}") String cacheDir) { this.trivyBinaryPath = trivyBinaryPath; this.cacheDir = cacheDir; this.outputFormat = "json"; } public TrivyScanResult scanImage(String imageName) throws IOException, InterruptedException { logger.info("Starting Trivy scan for image: {}", imageName); List<String> command = buildScanCommand(imageName); ProcessBuilder processBuilder = new ProcessBuilder(command); processBuilder.redirectErrorStream(true); Process process = processBuilder.start(); String output = readProcessOutput(process); int exitCode = process.waitFor(); if (exitCode != 0) { logger.error("Trivy scan failed with exit code: {}", exitCode); throw new TrivyScanException("Trivy scan failed: " + output); } return parseScanResult(output, imageName); } private List<String> buildScanCommand(String imageName) { List<String> command = new ArrayList<>(); command.add(trivyBinaryPath); command.add("image"); command.add("--format"); command.add(outputFormat); command.add("--cache-dir"); command.add(cacheDir); command.add("--security-checks"); command.add("vuln,config,secret"); command.add("--severity"); command.add("HIGH,CRITICAL"); command.add(imageName); return command; } private String readProcessOutput(Process process) throws IOException { try (BufferedReader reader = new BufferedReader( new InputStreamReader(process.getInputStream()))) { StringBuilder output = new StringBuilder(); String line; while ((line = reader.readLine()) != null) { output.append(line); } return output.toString(); } } private TrivyScanResult parseScanResult(String jsonOutput, String imageName) { try { ObjectMapper objectMapper = new ObjectMapper(); JsonNode rootNode = objectMapper.readTree(jsonOutput); TrivyScanResult result = new TrivyScanResult(imageName); // Parse vulnerabilities if (rootNode.has("Results")) { for (JsonNode resultNode : rootNode.get("Results")) { parseVulnerabilities(resultNode, result); parseMisconfigurations(resultNode, result); parseSecrets(resultNode, result); } } logger.info("Scan completed. Found {} vulnerabilities, {} misconfigurations, {} secrets", result.getVulnerabilities().size(), result.getMisconfigurations().size(), result.getSecrets().size()); return result; } catch (Exception e) { throw new TrivyScanException("Failed to parse Trivy scan results", e); } } private void parseVulnerabilities(JsonNode resultNode, TrivyScanResult result) { if (resultNode.has("Vulnerabilities")) { for (JsonNode vulnNode : resultNode.get("Vulnerabilities")) { Vulnerability vulnerability = new Vulnerability(); vulnerability.setVulnerabilityID(vulnNode.get("VulnerabilityID").asText()); vulnerability.setPkgName(vulnNode.get("PkgName").asText()); vulnerability.setInstalledVersion(vulnNode.get("InstalledVersion").asText()); if (vulnNode.has("FixedVersion")) { vulnerability.setFixedVersion(vulnNode.get("FixedVersion").asText()); } vulnerability.setSeverity(vulnNode.get("Severity").asText()); vulnerability.setTitle(vulnNode.get("Title").asText()); vulnerability.setDescription(vulnNode.get("Description").asText()); // Parse references if (vulnNode.has("References")) { List<String> references = new ArrayList<>(); for (JsonNode refNode : vulnNode.get("References")) { references.add(refNode.asText()); } vulnerability.setReferences(references); } result.getVulnerabilities().add(vulnerability); } } } private void parseMisconfigurations(JsonNode resultNode, TrivyScanResult result) { if (resultNode.has("Misconfigurations")) { for (JsonNode misconfigNode : resultNode.get("Misconfigurations")) { Misconfiguration misconfiguration = new Misconfiguration(); misconfiguration.setType(misconfigNode.get("Type").asText()); misconfiguration.setId(misconfigNode.get("ID").asText()); misconfiguration.setTitle(misconfigNode.get("Title").asText()); misconfiguration.setDescription(misconfigNode.get("Description").asText()); misconfiguration.setSeverity(misconfigNode.get("Severity").asText()); if (misconfigNode.has("Resolution")) { misconfiguration.setResolution(misconfigNode.get("Resolution").asText()); } result.getMisconfigurations().add(misconfiguration); } } } private void parseSecrets(JsonNode resultNode, TrivyScanResult result) { if (resultNode.has("Secrets")) { for (JsonNode secretNode : resultNode.get("Secrets")) { Secret secret = new Secret(); secret.setCategory(secretNode.get("Category").asText()); secret.setSeverity(secretNode.get("Severity").asText()); secret.setTitle(secretNode.get("Title").asText()); secret.setMatch(secretNode.get("Match").asText()); secret.setStartLine(secretNode.get("StartLine").asInt()); secret.setEndLine(secretNode.get("EndLine").asInt()); result.getSecrets().add(secret); } } } }

Method 2: REST API Integration

@Component public class TrivyApiClient { private static final Logger logger = LoggerFactory.getLogger(TrivyApiClient.class); private final WebClient webClient; private final String trivyApiUrl; public TrivyApiClient(@Value("${trivy.api.url:http://localhost:8080}") String trivyApiUrl) { this.trivyApiUrl = trivyApiUrl; this.webClient = WebClient.builder() .baseUrl(trivyApiUrl) .defaultHeader(HttpHeaders.CONTENT_TYPE, MediaType.APPLICATION_JSON_VALUE) .build(); } public TrivyScanResult scanImageViaApi(String imageName) { logger.info("Starting Trivy API scan for image: {}", imageName); try { // Start scan String scanId = startScan(imageName); // Wait for completion and get results return pollForScanResults(scanId, imageName); } catch (Exception e) { throw new TrivyScanException("Trivy API scan failed for image: " + imageName, e); } } private String startScan(String imageName) { Map<String, String> scanRequest = Map.of("image", imageName); return webClient.post() .uri("/scan") .bodyValue(scanRequest) .retrieve() .bodyToMono(ScanStartResponse.class) .map(ScanStartResponse::getScanId) .block(); } private TrivyScanResult pollForScanResults(String scanId, String imageName) throws InterruptedException { int maxAttempts = 30; int attempt = 0; while (attempt < maxAttempts) { ScanStatusResponse status = getScanStatus(scanId); switch (status.getStatus()) { case "completed": return getScanResults(scanId, imageName); case "failed": throw new TrivyScanException("Scan failed: " + status.getMessage()); case "running": Thread.sleep(2000); // Wait 2 seconds before polling again attempt++; break; default: throw new TrivyScanException("Unknown scan status: " + status.getStatus()); } } throw new TrivyScanException("Scan timed out for scan ID: " + scanId); } private ScanStatusResponse getScanStatus(String scanId) { return webClient.get() .uri("/scan/{scanId}/status", scanId) .retrieve() .bodyToMono(ScanStatusResponse.class) .block(); } private TrivyScanResult getScanResults(String scanId, String imageName) { String jsonResults = webClient.get() .uri("/scan/{scanId}/results", scanId) .retrieve() .bodyToMono(String.class) .block(); return parseApiScanResult(jsonResults, imageName); } private TrivyScanResult parseApiScanResult(String jsonResults, String imageName) { // Similar parsing logic as command line version // Implementation depends on Trivy API response format return new TrivyScanResult(imageName); // Simplified } // Response classes for API communication public static class ScanStartResponse { private String scanId; // getters and setters public String getScanId() { return scanId; } public void setScanId(String scanId) { this.scanId = scanId; } } public static class ScanStatusResponse { private String status; private String message; // getters and setters public String getStatus() { return status; } public void setStatus(String status) { this.status = status; } public String getMessage() { return message; } public void setMessage(String message) { this.message = message; } } }

Advanced Scanning Strategies

Multi-Stage Scanning Pipeline

@Service public class ContainerSecurityPipeline { private static final Logger logger = LoggerFactory.getLogger(ContainerSecurityPipeline.class); private final TrivyCommandLineScanner trivyScanner; private final VulnerabilityAnalyzer vulnerabilityAnalyzer; private final ComplianceChecker complianceChecker; private final ReportGenerator reportGenerator; public ContainerSecurityPipeline(TrivyCommandLineScanner trivyScanner, VulnerabilityAnalyzer vulnerabilityAnalyzer, ComplianceChecker complianceChecker, ReportGenerator reportGenerator) { this.trivyScanner = trivyScanner; this.vulnerabilityAnalyzer = vulnerabilityAnalyzer; this.complianceChecker = complianceChecker; this.reportGenerator = reportGenerator; } public PipelineResult executeSecurityScan(PipelineRequest request) { logger.info("Starting security scan pipeline for image: {}", request.getImageName()); PipelineResult result = new PipelineResult(request.getImageName()); try { // Stage 1: Vulnerability Scanning TrivyScanResult scanResult = trivyScanner.scanImage(request.getImageName()); result.setScanResult(scanResult); // Stage 2: Risk Analysis RiskAssessment riskAssessment = vulnerabilityAnalyzer.assessRisk(scanResult); result.setRiskAssessment(riskAssessment); // Stage 3: Compliance Checking ComplianceReport complianceReport = complianceChecker.checkCompliance(scanResult); result.setComplianceReport(complianceReport); // Stage 4: Generate Reports ScanReport scanReport = reportGenerator.generateReport(result); result.setScanReport(scanReport); // Stage 5: Policy Evaluation PolicyEvaluation policyEval = evaluatePolicies(result, request.getPolicies()); result.setPolicyEvaluation(policyEval); logger.info("Security scan pipeline completed successfully"); } catch (Exception e) { logger.error("Security scan pipeline failed", e); result.setSuccess(false); result.setErrorMessage(e.getMessage()); } return result; } private PolicyEvaluation evaluatePolicies(PipelineResult result, List<SecurityPolicy> policies) { PolicyEvaluation evaluation = new PolicyEvaluation(); for (SecurityPolicy policy : policies) { PolicyResult policyResult = evaluateSinglePolicy(result, policy); evaluation.addPolicyResult(policyResult); } return evaluation; } private PolicyResult evaluateSinglePolicy(PipelineResult result, SecurityPolicy policy) { PolicyResult policyResult = new PolicyResult(policy.getName()); switch (policy.getType()) { case "MAX_CRITICAL_VULNERABILITIES": int criticalCount = countVulnerabilitiesBySeverity(result.getScanResult(), "CRITICAL"); policyResult.setPassed(criticalCount <= policy.getThreshold()); policyResult.setMessage(String.format("Found %d critical vulnerabilities (threshold: %d)", criticalCount, policy.getThreshold())); break; case "ALLOWED_BASE_IMAGES": boolean baseImageAllowed = isBaseImageAllowed(result.getScanResult(), policy.getAllowedImages()); policyResult.setPassed(baseImageAllowed); policyResult.setMessage(baseImageAllowed ? "Base image is allowed" : "Base image is not in allowed list"); break; case "NO_EXPOSED_SECRETS": int secretCount = result.getScanResult().getSecrets().size(); policyResult.setPassed(secretCount == 0); policyResult.setMessage(String.format("Found %d exposed secrets", secretCount)); break; default: policyResult.setPassed(false); policyResult.setMessage("Unknown policy type: " + policy.getType()); } return policyResult; } private int countVulnerabilitiesBySeverity(TrivyScanResult scanResult, String severity) { return (int) scanResult.getVulnerabilities().stream() .filter(vuln -> severity.equalsIgnoreCase(vuln.getSeverity())) .count(); } private boolean isBaseImageAllowed(TrivyScanResult scanResult, List<String> allowedImages) { // Extract base image from scan result and check against allowed list // This is a simplified implementation String target = scanResult.getTarget().toLowerCase(); return allowedImages.stream() .anyMatch(allowed -> target.contains(allowed.toLowerCase())); } }

Vulnerability Analysis and Risk Assessment

@Service public class VulnerabilityAnalyzer { private static final Logger logger = LoggerFactory.getLogger(VulnerabilityAnalyzer.class); private final CveDatabaseService cveDatabaseService; private final ExploitabilityService exploitabilityService; public VulnerabilityAnalyzer(CveDatabaseService cveDatabaseService, ExploitabilityService exploitabilityService) { this.cveDatabaseService = cveDatabaseService; this.exploitabilityService = exploitabilityService; } public RiskAssessment assessRisk(TrivyScanResult scanResult) { logger.info("Assessing risk for {} vulnerabilities", scanResult.getVulnerabilities().size()); RiskAssessment assessment = new RiskAssessment(); for (Vulnerability vulnerability : scanResult.getVulnerabilities()) { VulnerabilityRisk risk = calculateVulnerabilityRisk(vulnerability); assessment.addVulnerabilityRisk(risk); } assessment.setOverallRiskScore(calculateOverallRiskScore(assessment)); assessment.setRiskLevel(determineRiskLevel(assessment.getOverallRiskScore())); logger.info("Risk assessment completed. Overall risk: {}", assessment.getRiskLevel()); return assessment; } private VulnerabilityRisk calculateVulnerabilityRisk(Vulnerability vulnerability) { VulnerabilityRisk risk = new VulnerabilityRisk(vulnerability); // Factor 1: Base severity double baseScore = getBaseSeverityScore(vulnerability.getSeverity()); // Factor 2: CVSS score (if available) double cvssScore = cveDatabaseService.getCvssScore(vulnerability.getVulnerabilityID()); // Factor 3: Exploitability double exploitabilityScore = exploitabilityService.getExploitabilityScore( vulnerability.getVulnerabilityID()); // Factor 4: Fix availability double fixAvailabilityScore = getFixAvailabilityScore(vulnerability); // Calculate composite risk score double compositeScore = (baseScore * 0.3) + (cvssScore * 0.3) + (exploitabilityScore * 0.3) + (fixAvailabilityScore * 0.1); risk.setRiskScore(compositeScore); risk.setRiskLevel(determineVulnerabilityRiskLevel(compositeScore)); return risk; } private double getBaseSeverityScore(String severity) { switch (severity.toUpperCase()) { case "CRITICAL": return 10.0; case "HIGH": return 7.5; case "MEDIUM": return 5.0; case "LOW": return 2.5; default: return 1.0; } } private double getFixAvailabilityScore(Vulnerability vulnerability) { if (vulnerability.getFixedVersion() != null && !vulnerability.getFixedVersion().isEmpty()) { return 1.0; // Fix available } return 5.0; // No fix available, higher risk } private double calculateOverallRiskScore(RiskAssessment assessment) { return assessment.getVulnerabilityRisks().stream() .mapToDouble(VulnerabilityRisk::getRiskScore) .max() .orElse(0.0); } private String determineRiskLevel(double riskScore) { if (riskScore >= 8.0) return "CRITICAL"; if (riskScore >= 6.0) return "HIGH"; if (riskScore >= 4.0) return "MEDIUM"; if (riskScore >= 2.0) return "LOW"; return "NONE"; } private String determineVulnerabilityRiskLevel(double riskScore) { if (riskScore >= 7.0) return "HIGH"; if (riskScore >= 4.0) return "MEDIUM"; return "LOW"; } }

CI/CD Integration

Jenkins Pipeline Integration

@Component public class JenkinsTrivyIntegration { private static final Logger logger = LoggerFactory.getLogger(JenkinsTrivyIntegration.class); private final TrivyCommandLineScanner trivyScanner; private final JenkinsClient jenkinsClient; public JenkinsTrivyIntegration(TrivyCommandLineScanner trivyScanner, JenkinsClient jenkinsClient) { this.trivyScanner = trivyScanner; this.jenkinsClient = jenkinsClient; } public void integrateSecurityScan(String imageName, String buildUrl) { logger.info("Integrating Trivy scan into Jenkins build: {}", buildUrl); try { // Perform security scan TrivyScanResult scanResult = trivyScanner.scanImage(imageName); // Generate report String report = generateJenkinsReport(scanResult); // Post results to Jenkins jenkinsClient.postBuildAction(buildUrl, "trivy-security-scan", report); // Fail build if critical vulnerabilities found if (hasCriticalVulnerabilities(scanResult)) { jenkinsClient.failBuild(buildUrl, "Critical vulnerabilities detected"); throw new SecurityPolicyViolationException("Critical vulnerabilities found"); } logger.info("Security scan integration completed successfully"); } catch (Exception e) { logger.error("Security scan integration failed", e); jenkinsClient.failBuild(buildUrl, "Security scan failed: " + e.getMessage()); throw e; } } private String generateJenkinsReport(TrivyScanResult scanResult) { StringBuilder report = new StringBuilder(); report.append("## Trivy Security Scan Report\n\n"); // Vulnerabilities section report.append("### Vulnerabilities\n"); report.append(String.format("**Total:** %d\n\n", scanResult.getVulnerabilities().size())); Map<String, Long> severityCounts = scanResult.getVulnerabilities().stream() .collect(Collectors.groupingBy(Vulnerability::getSeverity, Collectors.counting())); for (String severity : List.of("CRITICAL", "HIGH", "MEDIUM", "LOW", "UNKNOWN")) { long count = severityCounts.getOrDefault(severity, 0L); report.append(String.format("- **%s:** %d\n", severity, count)); } // Misconfigurations section if (!scanResult.getMisconfigurations().isEmpty()) { report.append("\n### Misconfigurations\n"); report.append(String.format("**Total:** %d\n\n", scanResult.getMisconfigurations().size())); } // Secrets section if (!scanResult.getSecrets().isEmpty()) { report.append("\n### Exposed Secrets\n"); report.append(String.format("**Total:** %d\n\n", scanResult.getSecrets().size())); } return report.toString(); } private boolean hasCriticalVulnerabilities(TrivyScanResult scanResult) { return scanResult.getVulnerabilities().stream() .anyMatch(vuln -> "CRITICAL".equalsIgnoreCase(vuln.getSeverity())); } }

GitHub Actions Integration

@Component public class GitHubActionsIntegration { private static final Logger logger = LoggerFactory.getLogger(GitHubActionsIntegration.class); private final TrivyCommandLineScanner trivyScanner; private final GitHubClient gitHubClient; public GitHubActionsIntegration(TrivyCommandLineScanner trivyScanner, GitHubClient gitHubClient) { this.trivyScanner = trivyScanner; this.gitHubClient = gitHubClient; } public void createSecurityCheck(String owner, String repo, String sha, String imageName) { logger.info("Creating security check for {}/{}@{}", owner, repo, sha); try { TrivyScanResult scanResult = trivyScanner.scanImage(imageName); SecurityCheckResult checkResult = analyzeScanResults(scanResult); gitHubClient.createCheckRun(owner, repo, sha, "trivy-security-scan", checkResult); logger.info("Security check created successfully"); } catch (Exception e) { logger.error("Failed to create security check", e); throw new SecurityScanException("GitHub Actions integration failed", e); } } private SecurityCheckResult analyzeScanResults(TrivyScanResult scanResult) { SecurityCheckResult result = new SecurityCheckResult(); int criticalCount = countVulnerabilitiesBySeverity(scanResult, "CRITICAL"); int highCount = countVulnerabilitiesBySeverity(scanResult, "HIGH"); if (criticalCount > 0) { result.setConclusion("failure"); result.setTitle(String.format("%d critical vulnerabilities found", criticalCount)); } else if (highCount > 0) { result.setConclusion("neutral"); result.setTitle(String.format("%d high vulnerabilities found", highCount)); } else { result.setConclusion("success"); result.setTitle("No critical or high vulnerabilities found"); } result.setSummary(generateCheckSummary(scanResult)); result.setText(generateCheckDetails(scanResult)); return result; } private String generateCheckSummary(TrivyScanResult scanResult) { return String.format( "**Security Scan Results:**\n" + "- Total Vulnerabilities: %d\n" + "- Critical: %d\n" + "- High: %d\n" + "- Medium: %d\n" + "- Low: %d", scanResult.getVulnerabilities().size(), countVulnerabilitiesBySeverity(scanResult, "CRITICAL"), countVulnerabilitiesBySeverity(scanResult, "HIGH"), countVulnerabilitiesBySeverity(scanResult, "MEDIUM"), countVulnerabilitiesBySeverity(scanResult, "LOW") ); } private int countVulnerabilitiesBySeverity(TrivyScanResult scanResult, String severity) { return (int) scanResult.getVulnerabilities().stream() .filter(vuln -> severity.equalsIgnoreCase(vuln.getSeverity())) .count(); } }

Configuration Management

Spring Boot Configuration

# application.yml trivy: binary: path: /usr/local/bin/trivy cache: dir: /tmp/trivy-cache api: url: http://trivy-server:8080 security: checks: vuln,config,secret severity: HIGH,CRITICAL timeout: 300s security: scanning: enabled: true fail-on-critical: true policies: - name: no-critical-vulns type: MAX_CRITICAL_VULNERABILITIES threshold: 0 - name: allowed-base-images type: ALLOWED_BASE_IMAGES allowed-images: - openjdk:11-jre - eclipse-temurin:17-jre

Configuration Class

@Configuration @ConfigurationProperties(prefix = "trivy") public class TrivyConfiguration { private Binary binary = new Binary(); private Cache cache = new Cache(); private Api api = new Api(); private Security security = new Security(); // Getters and setters public static class Binary { private String path = "/usr/local/bin/trivy"; // getters and setters } public static class Cache { private String dir = "/tmp/trivy-cache"; // getters and setters } public static class Api { private String url = "http://localhost:8080"; // getters and setters } public static class Security { private String checks = "vuln,config,secret"; private String severity = "HIGH,CRITICAL"; private Duration timeout = Duration.ofSeconds(300); // getters and setters } }

Monitoring and Metrics

@Component public class TrivyMetricsCollector { private final MeterRegistry meterRegistry; public TrivyMetricsCollector(MeterRegistry meterRegistry) { this.meterRegistry = meterRegistry; } public void recordScanMetrics(TrivyScanResult result, Duration duration, boolean success) { // Record scan duration meterRegistry.timer("trivy.scan.duration") .record(duration); // Record vulnerability counts by severity Map<String, Long> severityCounts = result.getVulnerabilities().stream() .collect(Collectors.groupingBy(Vulnerability::getSeverity, Collectors.counting())); for (Map.Entry<String, Long> entry : severityCounts.entrySet()) { meterRegistry.gauge("trivy.vulnerabilities.count", Tags.of("severity", entry.getKey().toLowerCase()), entry.getValue()); } // Record scan success/failure meterRegistry.counter("trivy.scan.result", Tags.of("success", Boolean.toString(success))) .increment(); // Record misconfigurations and secrets meterRegistry.gauge("trivy.misconfigurations.count", result.getMisconfigurations().size()); meterRegistry.gauge("trivy.secrets.count", result.getSecrets().size()); } public void recordPolicyViolation(String policyName, String imageName) { meterRegistry.counter("trivy.policy.violation", Tags.of( "policy", policyName, "image", imageName )).increment(); } }

Best Practices

1. Performance Optimization

Use Trivy's caching mechanism effectively
Schedule scans during off-peak hours
Use incremental scanning when possible
Parallelize scans for multiple images

2. Security Considerations

Run Trivy in isolated environments
Secure Trivy API endpoints
Rotate API keys regularly
Encrypt sensitive scan results

3. Integration Patterns

Fail builds on critical vulnerabilities
Generate actionable reports
Integrate with ticketing systems for remediation
Implement automated remediation workflows

4. Monitoring and Alerting

Monitor scan success rates
Alert on critical vulnerability detection
Track vulnerability trends over time
Monitor Trivy database update status

Conclusion

Trivy provides comprehensive container security scanning that can be effectively integrated into Java applications:

Vulnerability Detection: OS packages and application dependencies
Misconfiguration Scanning: Dockerfile and Kubernetes configurations
Secret Detection: Exposed credentials and sensitive information
Compliance Checking: CIS benchmarks and custom policies

Key integration benefits:

Automated Security: CI/CD pipeline integration
Comprehensive Coverage: Multiple scan types in one tool
Actionable Results: Detailed vulnerability information
Policy Enforcement: Custom security policies

By integrating Trivy into Java applications, organizations can achieve continuous security monitoring and enforcement throughout the software development lifecycle.