Home / aquasecurity / trivy
Repository Analysis

aquasecurity/trivy

Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more

1.1 Likely human-written View on GitHub
1.1
Adjusted Score
1.1
Raw Score
100%
Time Factor
2026-05-29
Last Push
35,245
Stars
Go
Language
324,235
Lines of Code
2473
Files
140
Pattern Hits
2026-05-31
Scan Date

Score History

Severity Breakdown

CRITICAL 12HIGH 0MEDIUM 23LOW 105

Pattern Findings

140 matches across 8 categories. Click a row to expand file-level details.

Hallucination Indicators12 hits · 180 pts
SeverityFileLineSnippet
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go160 assert.Equal(t, 15, cluster.Logging.Broker.Cloudwatch.Metadata.Range().GetStartLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go161 assert.Equal(t, 18, cluster.Logging.Broker.Cloudwatch.Metadata.Range().GetEndLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go163 assert.Equal(t, 16, cluster.Logging.Broker.Cloudwatch.Enabled.GetMetadata().Range().GetStartLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go164 assert.Equal(t, 16, cluster.Logging.Broker.Cloudwatch.Enabled.GetMetadata().Range().GetEndLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go166 assert.Equal(t, 19, cluster.Logging.Broker.Firehose.Metadata.Range().GetStartLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go167 assert.Equal(t, 22, cluster.Logging.Broker.Firehose.Metadata.Range().GetEndLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go169 assert.Equal(t, 20, cluster.Logging.Broker.Firehose.Enabled.GetMetadata().Range().GetStartLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go170 assert.Equal(t, 20, cluster.Logging.Broker.Firehose.Enabled.GetMetadata().Range().GetEndLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go172 assert.Equal(t, 23, cluster.Logging.Broker.S3.Metadata.Range().GetStartLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go173 assert.Equal(t, 27, cluster.Logging.Broker.S3.Metadata.Range().GetEndLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go175 assert.Equal(t, 24, cluster.Logging.Broker.S3.Enabled.GetMetadata().Range().GetStartLine())
CRITICALpkg/iac/adapters/terraform/aws/msk/adapt_test.go176 assert.Equal(t, 24, cluster.Logging.Broker.S3.Enabled.GetMetadata().Range().GetEndLine())
Over-Commented Block96 hits · 96 pts
SeverityFileLineSnippet
LOWintegration/sbom_test.go101 })
LOWdocs/guide/advanced/modules.md261 // e.g. results
LOWdocs/guide/compliance/compliance.md121# - input: schema["kubernetes"]
LOWdocs/guide/scanner/misconfiguration/index.md321
LOWdocs/guide/scanner/misconfiguration/custom/selectors.md1# Input Selectors
LOWdocs/tutorials/misconfiguration/custom-checks.md21```
LOWdocs/community/contribute/checks/overview.md21# scope: package
LOWexamples/module/spring4shell/spring4shell.go141// PostScan takes results including custom resources and detected CVE-2022-22965.
LOWexamples/module/spring4shell/spring4shell.go161// "FilePath": "/usr/local/tomcat/RELEASE-NOTES",
LOWexamples/module/spring4shell/spring4shell.go181// "Layer": {
LOWexamples/module/spring4shell/spring4shell.go201// "redhat": 3
LOWrpc/cache/service.twirp.go1361}
LOWrpc/cache/service.twirp.go1381// service. Those accessors are a low-level API for building reflection tools.
LOWrpc/scanner/service.twirp.go521 return baseServicePath(s.pathPrefix, "trivy.scanner.v1", "Scanner")
LOWrpc/scanner/service.twirp.go541// HTTP handlers with additional methods for accessing metadata about the
LOWhelm/trivy/values.yaml61 debugMode: false
LOWhelm/trivy/values.yaml81 #
LOWpkg/result/ignore.go21 "github.com/aquasecurity/trivy/pkg/log"
LOWpkg/fingerprint/fingerprint.go21 // TODO: Future implementation
LOWpkg/sbom/core/bom.go101 // It's transparently generated by UUIDv4
LOWpkg/sbom/core/bom.go121 Group string
LOWpkg/sbom/core/bom.go141 SrcFile string
LOWpkg/sbom/io/encode.go181
LOWpkg/sbom/io/encode.go201 // -> Library component (vim-8.2) ------------------ #3
LOWpkg/sbom/io/encode.go281
LOWpkg/sbom/io/encode.go501
LOWpkg/fanal/image/image.go81 layerIDs = append(layerIDs, d.String())
LOWpkg/fanal/image/image.go101// In total, it would be like:
LOWpkg/fanal/analyzer/language/golang/mod/mod.go261// This situation can occur when:
LOWpkg/fanal/walker/fs.go101 absBase, err := filepath.Abs(base)
LOWpkg/dependency/parser/nodejs/pnpm/parse_testcase.go601 // cd ./node_modules/lodash/
LOWpkg/dependency/parser/nodejs/pnpm/types.go1package pnpm
LOWpkg/dependency/parser/nodejs/pnpm/parse.go301// e.g.
LOWpkg/dependency/parser/nodejs/npm/parse_testcase.go1301
LOWpkg/dependency/parser/python/uv/parse_testcase.go1package uv
LOWpkg/dependency/parser/python/poetry/parse_testcase.go1package poetry
LOWpkg/dependency/parser/golang/binary/parse.go161// The priority order is:
LOWpkg/dependency/parser/golang/binary/parse.go221 }
LOWpkg/dependency/parser/java/pom/mirror.go61 url: *u,
LOWpkg/dependency/parser/java/pom/parse_test.go1401 },
LOWpkg/dependency/parser/java/pom/parse_test.go1481 },
LOWpkg/dependency/parser/java/pom/parse_test.go1501 //[INFO]
LOWpkg/dependency/parser/java/pom/parse_test.go2161 },
LOWpkg/dependency/parser/java/pom/parse_test.go2241 },
LOWpkg/dependency/parser/java/pom/settings_test.go121 },
LOWpkg/dependency/parser/java/pom/settings_test.go141 // <server>
LOWpkg/dependency/parser/java/pom/settings_test.go161 // </snapshots>
LOWpkg/dependency/parser/java/pom/settings_test.go181 // <repository>
LOWpkg/dependency/parser/java/jar/parse_test.go181 //│ └── foo
LOWpkg/dependency/parser/ruby/gemspec/parse.go21 // e.g. Gem::Specification.new do |s|
LOWpkg/iac/rego/embed_test.go41# scope: package
LOWpkg/iac/rego/embed_test.go61# custom:
LOWpkg/iac/rego/embed_test.go121# title: "deprecated check"
LOWpkg/iac/rego/embed_test.go161 },
LOWpkg/iac/rego/scanner_test.go21
LOWpkg/iac/rego/scanner_test.go161 t.Setenv("DEFSEC_RUNTIME_VAL", "AOK")
LOWpkg/iac/rego/scanner_test.go201 assert.Empty(t, results.GetPassed())
LOWpkg/iac/rego/scanner_test.go301 assert.Equal(t, 456, results.GetFailed()[0].Metadata().Range().GetEndLine())
LOWpkg/iac/rego/scanner_test.go421 "policies/test.rego": `# METADATA
LOWpkg/iac/rego/scanner_test.go501 srcFS := testutil.CreateFS(map[string]string{
36 more matches not shown…
Self-Referential Comments16 hits · 52 pts
SeverityFileLineSnippet
MEDIUMmisc/backport/backport.sh24# Create a new branch with the PR number and branch name
MEDIUMmisc/backport/backport.sh30# Create the pull request title
MEDIUMmisc/backport/backport.sh33# Create the pull request description
MEDIUMmisc/backport/backport.sh65# Create a new pull request with the original PR title, backport suffix, and description
MEDIUM…alyzer/language/julia/pkg/testdata/happy/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…age/julia/pkg/testdata/shadowed_dep_v1.9/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…language/julia/pkg/testdata/dep_ext_v1.9/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…language/julia/pkg/testdata/no_deps_v1.6/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…lia/manifest/testdata/multiple-same-deps/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…ulia/manifest/testdata/shadowed_dep_v1.9/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…julia/manifest/testdata/missed-child-dep/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…ser/julia/manifest/testdata/dep_ext_v1.9/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…ser/julia/manifest/testdata/no_deps_v1.6/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…ser/julia/manifest/testdata/no_deps_v1.9/Manifest.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…ser/julia/manifest/testdata/primary/Manifest_v1.8.toml1# This file is machine-generated - editing it directly is not advised
MEDIUM…ser/julia/manifest/testdata/primary/Manifest_v1.6.toml1# This file is machine-generated - editing it directly is not advised
Slop Phrases6 hits · 12 pts
SeverityFileLineSnippet
LOWhelm/trivy/values.yaml109 # In case you specify redis as backend, make sure you installed a redis server yourself, e.g.
MEDIUMpkg/vex/testdata/csaf.json8 "text": "Example Company VEX document. Unofficial content for demonstration purposes only.",
MEDIUMpkg/iac/adapters/terraform/aws/apigateway/apiv1_test.go23 description = "This is my API for demonstration purposes"
MEDIUMpkg/iac/adapters/terraform/aws/apigateway/apiv1_test.go50 description = "This is my API for demonstration purposes"
MEDIUMpkg/iac/adapters/terraform/aws/apigateway/adapt_test.go29 description = "This is my API for demonstration purposes"
MEDIUMpkg/iac/adapters/terraform/aws/apigateway/adapt_test.go142 description = "This is my API for demonstration purposes"
Verbosity Indicators5 hits · 8 pts
SeverityFileLineSnippet
LOWpkg/dependency/parser/nodejs/pnpm/parse.go113 // Step 1: Extract direct dependencies from the "importers" section.
LOWpkg/dependency/parser/nodejs/pnpm/parse.go128 // Step 2: Process each snapshot to create package entries.
LOWpkg/dependency/parser/nodejs/pnpm/parse.go145 // Step 3: Determine if this package is a direct or transitive dependency,
LOWpkg/dependency/parser/nodejs/pnpm/parse.go174 // Step 4: Build the dependency graph by recording what this package depends on.
LOWpkg/dependency/parser/nodejs/pnpm/parse.go192 // Step 5: Propagate the "production" status to all transitive dependencies.
AI Slop Vocabulary2 hits · 6 pts
SeverityFileLineSnippet
MEDIUMpkg/fanal/artifact/image/image.go204 // TODO(knqyf263): refactor to use a more robust method instead of suffix-based detection
MEDIUMpkg/iac/scanners/terraform/parser/funcs/datetime.go147 // be robust here.
Example Usage Blocks1 hit · 2 pts
SeverityFileLineSnippet
LOWpkg/x/json/jsonc.go60// Usage example:
Hyper-Verbose Identifiers2 hits · 1 pts
SeverityFileLineSnippet
LOW…eDir/.conan/data/openssl/3.0.5/_/_/export/conanfile.py572 def _create_cmake_module_variables(self, module_file):
LOW…stdata/cacheDir_v2/p/opens464b5c427ce9d/e/conanfile.py572 def _create_cmake_module_variables(self, module_file):