Filesystem Scanning: Uncovering Vulnerabilities and Secrets with Trivy

Filesystem scanning is crucial for maintaining security in your applications. With the rise of complex dependencies, vulnerabilities and misconfigurations can easily slip through the cracks. Trivy addresses this by scanning local projects for vulnerabilities, misconfigurations, secrets, and licenses, helping you catch these issues before they become a problem.

Trivy operates with a simple command: $trivy fs/path/to/project. By default, it scans for vulnerabilities and secrets, while misconfigurations and licenses are disabled. If you want to enable misconfiguration scanning, you can do so with the parameter --scanners misconfig. Similarly, to check for licenses, use --scanners license/path/to/project. Trivy also supports caching; however, it doesn't use the cache by default unless your local project is a git repository with a clean status and a cache backend other than memory is enabled.

In production, remember that while Trivy's vulnerability and secret scanning is enabled by default, you must actively enable misconfigurations and licenses. A common gotcha is that if the OS isn't detected, vulnerabilities in OS packages won't be identified. Always ensure your environment is properly configured to get the most out of Trivy's scanning capabilities.