{
 "schema_version": 1,
 "generated": "2026-10-31",
 "id": "aquasecurity-trivy--scan-a-project-for-vulns-secrets-and-misconfigs",
 "repo": "aquasecurity/trivy",
 "repo_url": "https://github.com/aquasecurity/trivy",
 "repo_slug": "aquasecurity-trivy",
 "title": "Check a project folder for vulnerabilities, secrets and misconfigurations",
 "page_title": "How to check a project folder for vulnerabilities, secrets and misconfigurations with Trivy",
 "summary": "Run one Trivy fs command that looks for vulnerable dependencies, leaked secrets and IaC mistakes.",
 "who": "A developer cleaning up a project before open sourcing it or handing it to a client.",
 "problem": "Separate tools for dependencies, secrets and Terraform or Kubernetes files are a hassle to run together.",
 "outcome": "One report covering vulnerable dependencies, exposed secrets and infrastructure misconfigurations.",
 "steps": [
  "Install Trivy with `brew install trivy`",
  "Run `trivy fs --scanners vuln,secret,misconfig myproject/` on your project folder",
  "Fix or rotate any secrets it finds first",
  "Upgrade the flagged dependencies and correct the IaC issues and misconfigurations",
  "Rerun the same command until the report is clean enough to ship"
 ],
 "agent_prompt": "Run aquasecurity/trivy fs with the vuln, secret and misconfig scanners on <project folder>. Group the findings by type, propose fixes for each, and list any secrets I must rotate.",
 "agents": [
  "claude-code",
  "codex",
  "cursor"
 ],
 "difficulty": "Beginner",
 "time": "15 minutes",
 "basis": "readme",
 "caveat": "Misconfiguration checks follow general best practice, so some findings may be intentional choices for your environment.",
 "category": "Security and science",
 "tags": [
  "Security and science"
 ],
 "lang": "go",
 "requirements": [
  "Trivy via `brew install trivy`, the aquasec/trivy Docker image, or a release binary",
  "Access to the image, folder, repo or Kubernetes cluster you want to scan"
 ],
 "risk": "none",
 "seen_in_the_wild": false,
 "mentioned_publicly": false,
 "risks": [],
 "best": false,
 "score": 0.9,
 "evidence": [],
 "url": "https://dedupedai.com/use-cases/aquasecurity-trivy/scan-a-project-for-vulns-secrets-and-misconfigs/",
 "md": "https://dedupedai.com/use-cases/aquasecurity-trivy/scan-a-project-for-vulns-secrets-and-misconfigs/index.md",
 "disclaimer": "Deduped lists open-source repositories that belong to other people. We do not own, maintain, audit, or vouch for any of them, and a repo appearing here is not an endorsement or a safety check. The use cases, steps, and prompts are written by AI and may be incomplete, outdated, or just wrong. Where a use case is marked \"Seen in the wild\", we link to public posts where someone described something similar, but we have not verified those posts and the use case itself is still our AI's own write-up. Use all of this at your own risk. Only run code, commands, or agents on systems and accounts you are authorized to use, and read the code and every command before you run it, especially anything that touches credentials, files, or the network. Nothing here is professional, security, legal, or financial advice. All trademarks and project names belong to their respective owners, and their use here does not imply affiliation. Content is provided as is, without warranties of any kind. Found a mistake, a safety problem, or something you want removed? Email hello@dedupedai.com and we will look at it promptly.",
 "api": "https://dedupedai.com/api/v1/usecases/aquasecurity-trivy--scan-a-project-for-vulns-secrets-and-misconfigs.json",
 "api_version": "v1"
}