Container & IaC Misconfiguration Scanner

Audit the Dockerfile, Kubernetes manifests, Terraform, CloudFormation and Helm charts in your repository for insecure defaults — root containers, privileged pods, public storage, unpinned base images, secrets passed as build args.

Run this scan See pricing

How this scan works

Needs a connected GitHub repository
Finds and audits every Dockerfile, Kubernetes manifest, Terraform file, Terraform plan, CloudFormation template, Helm chart and Azure ARM template in the repo
Container checks — image running as root, no USER instruction, writable root filesystem, secrets passed as build args, unpinned/:latest base image tags, missing HEALTHCHECK
Kubernetes checks — privileged containers, host namespace sharing, missing resource limits, containers allowed to escalate privileges
Cloud infrastructure checks — publicly readable storage buckets, unencrypted volumes, security groups open to 0.0.0.0/0, missing logging
Does not cover docker-compose.yml or GitHub Actions workflows — Trivy doesn’t scan either. Your workflows are audited separately by the GitHub Actions Supply Chain Scanner
Reports the specific file and line for every finding, with the concrete resolution for that rule
Groups by rule so each row names one fix; beyond 12 distinct rules the remainder rolls into a single summary row
This is configuration analysis, not a scan of a built container image — it reads the files in your repo, so nothing needs to be pushed to a registry

More checks in Configuration

Security Headers Scanner SSL/TLS Security Scanner Cookie & Session Security Scanner Mobile Interface Scanner Supabase Security Scanner Firebase Security Scanner