Trivy Integrations

Chainguard Containers provide a trusted set of minimal, zero-CVE container images with a top-tier CVE remediation SLA—addressing critical vulnerabilities within 7 days, and high, medium, and low within 14—enabling teams to build and deploy software more confidently. As modern development workflows and CI/CD pipelines depend on secure, up-to-date containers for cloud-native applications, Chainguard offers streamlined images built entirely from source in a hardened, secure build environment. Designed for both engineering and security stakeholders, Chainguard Containers reduce the manual overhead of managing vulnerabilities, improve application resilience by shrinking the attack surface, and accelerate go-to-market by simplifying alignment with compliance standards and customer security expectations.

Kubernetes (K8s) is a powerful open-source platform designed to automate the deployment, scaling, and management of applications that are containerized. By organizing containers into manageable groups, it simplifies the processes of application management and discovery. Drawing from over 15 years of experience in handling production workloads at Google, Kubernetes also incorporates the best practices and innovative ideas from the wider community. Built on the same foundational principles that enable Google to efficiently manage billions of containers weekly, it allows for scaling without necessitating an increase in operational personnel. Whether you are developing locally or operating a large-scale enterprise, Kubernetes adapts to your needs, providing reliable and seamless application delivery regardless of complexity. Moreover, being open-source, Kubernetes offers the flexibility to leverage on-premises, hybrid, or public cloud environments, facilitating easy migration of workloads to the most suitable infrastructure. This adaptability not only enhances operational efficiency but also empowers organizations to respond swiftly to changing demands in their environments.

Docker streamlines tedious configuration processes and is utilized across the entire development lifecycle, facilitating swift, simple, and portable application creation on both desktop and cloud platforms. Its all-encompassing platform features user interfaces, command-line tools, application programming interfaces, and security measures designed to function cohesively throughout the application delivery process. Jumpstart your programming efforts by utilizing Docker images to craft your own distinct applications on both Windows and Mac systems. With Docker Compose, you can build multi-container applications effortlessly. Furthermore, it seamlessly integrates with tools you already use in your development workflow, such as VS Code, CircleCI, and GitHub. You can package your applications as portable container images, ensuring they operate uniformly across various environments, from on-premises Kubernetes to AWS ECS, Azure ACI, Google GKE, and beyond. Additionally, Docker provides access to trusted content, including official Docker images and those from verified publishers, ensuring quality and reliability in your application development journey. This versatility and integration make Docker an invaluable asset for developers aiming to enhance their productivity and efficiency.

Visual Studio Code is a highly extensible AI-powered code editor built for developers who demand flexibility and performance. It combines intelligent coding assistance, modern debugging tools, and collaboration features in one lightweight package. With Agent Mode, VS Code reads your codebase, runs terminal commands, and edits across files automatically until tasks are complete. Its Next Edit Suggestions feature predicts and completes your next move as you type, enhancing speed and code accuracy. The Model Context Protocol (MCP) enables developers to connect their favorite AI models—from OpenAI, Anthropic, Azure, or Google—and extend functionality through custom servers. Developers can work in any language, from JavaScript and Python to C#, Java, and Go, while leveraging over 75,000 extensions for added productivity. Seamless integration with GitHub Codespaces, cloud storage, and CI/CD tools allows teams to code, collaborate, and deploy anywhere. Open-source at its core, VS Code empowers both individuals and enterprises to innovate without limits.

IntelliJ IDEA is a powerful and versatile IDE tailored for professional Java and Kotlin developers who want to maximize their productivity and code quality. It provides comprehensive support across the entire development process, including design, coding, debugging, testing, and deployment. With smart code analysis, safe refactoring, and error detection, IntelliJ IDEA minimizes bugs and technical debt so developers can focus on innovation. The latest version adds full support for Java 24 features and enables Kotlin’s K2 mode by default, improving performance and memory efficiency. New interactive Kotlin notebooks allow real-time prototyping and data visualization within the IDE. IntelliJ IDEA also includes advanced debugging tools like the Spring Debugger for managing dynamic database connections. JetBrains prioritizes developer comfort with an intuitive interface and customizable settings. The IDE adheres to strict privacy and security standards, ensuring developers’ data remains protected.

GitHub stands as the leading platform for developers globally, renowned for its security, scalability, and community appreciation. By joining the ranks of millions of developers and businesses, you can contribute to the software that drives the world forward. Collaborate within the most inventive communities, all while utilizing our top-tier tools, support, and services. If you're overseeing various contributors, take advantage of our free GitHub Team for Open Source option. Additionally, GitHub Sponsors is available to assist in financing your projects. We're thrilled to announce the return of The Pack, where we’ve teamed up to provide students and educators with complimentary access to premier developer tools throughout the academic year and beyond. Furthermore, if you work for a recognized nonprofit, association, or a 501(c)(3), we offer a discounted Organization account to support your mission. With these offerings, GitHub continues to empower diverse users in their software development journeys.

AWS is the leading provider of cloud computing, delivering over 200 fully featured services to organizations worldwide. Its offerings cover everything from infrastructure—such as compute, storage, and networking—to advanced technologies like artificial intelligence, machine learning, and agentic AI. Businesses use AWS to modernize legacy systems, run high-performance workloads, and build scalable, secure applications. Core services like Amazon EC2, Amazon S3, and Amazon DynamoDB provide foundational capabilities, while advanced solutions like SageMaker and AWS Transform enable AI-driven transformation. The platform is supported by a global infrastructure that includes 38 regions, 120 availability zones, and 400+ edge locations, ensuring low latency and high reliability. AWS integrates with leading enterprise tools, developer SDKs, and partner ecosystems, giving teams the flexibility to adopt cloud at their own pace. Its training and certification programs help individuals and companies grow cloud expertise with industry-recognized credentials. With its unmatched breadth, depth, and proven track record, AWS empowers organizations to innovate and compete in the digital-first economy.

Git is a powerful and freely available distributed version control system that is built to manage projects of any size swiftly and effectively. Its user-friendly nature and minimal resource requirements contribute to its remarkable speed. Git surpasses traditional source control management tools such as Subversion, CVS, Perforce, and ClearCase by offering advantages like inexpensive local branching, user-friendly staging areas, and diverse workflow options. Additionally, you can interact with configurations through this command, where the name represents the section and the key separated by a dot, while the value is appropriately escaped. This versatility in handling version control makes Git an essential tool for developers and teams alike.

Utilize integrated software delivery tools to share code, monitor tasks, and deploy software, all hosted on your premises. Whether you choose to leverage the full suite of Azure DevOps services or just a select few, these tools can seamlessly enhance your current workflows. Formerly recognized as Team Foundation Server (TFS), Azure DevOps Server provides a comprehensive set of collaborative tools for software development, tailored for on-premises use. By integrating with your preferred IDE or editor, Azure DevOps Server empowers your diverse team to collaborate effectively on projects, regardless of their scale. This powerful software includes robust source code management capabilities, along with features such as access controls and permissions, bug tracking, build automation, change management, code reviews, collaboration, continuous integration, and version control, to support your development process in a holistic manner. With Azure DevOps Server, teams can streamline their development cycles and enhance productivity, ensuring that software delivery is efficient and reliable.

Enhance your development workflow by utilizing CI, whether it’s in the cloud or on your own private server. Seize the opportunity to oversee your code and manage all sources of modifications. With CircleCI, you can validate changes at each phase, ensuring that you can roll out updates precisely when your users require them, with confidence in their reliability. Experience the freedom to innovate without restrictions, as our platform supports coding in various languages and across diverse execution environments. If you can conceive it, we possess the capability to build, test, and deploy it seamlessly. Our adaptable environments, coupled with thousands of pre-existing integrations, ensure that your pipelines are only limited by your imagination. Furthermore, we are proud to be the sole CI/CD platform achieving FedRAMP certification and SOC 2 Type II compliance. You gain comprehensive control over your code with built-in functionalities such as audit logs, OpenID Connect, third-party secrets management, and LDAP, empowering you to manage your development process with utmost security and efficiency. This level of control allows you to innovate while staying compliant with industry standards.

SonarQube Server serves as a self-hosted solution for ongoing code quality assessment, enabling development teams to detect and address bugs, vulnerabilities, and code issues in real time. It delivers automated static analysis across multiple programming languages, ensuring that the highest standards of quality and security are upheld throughout the software development process. Additionally, SonarQube Server integrates effortlessly with current CI/CD workflows, providing options for both on-premise and cloud deployments. Equipped with sophisticated reporting capabilities, it assists teams in managing technical debt, monitoring progress, and maintaining coding standards. This platform is particularly well-suited for organizations desiring comprehensive oversight of their code quality and security while maintaining high performance levels. Furthermore, SonarQube fosters a culture of continuous improvement within development teams, encouraging proactive measures to enhance code integrity over time.

Vim is a versatile and highly customizable text editor designed for efficient text creation and modification. It is commonly included as "vi" on most UNIX systems and is also available on Apple OS X. Known for its stability, Vim is under continuous development to enhance its features further. The editor supports multi-level persistence, boasts an extensive plugin ecosystem, and accommodates a wide range of programming languages and file formats, along with a powerful search and replace functionality, making it a valuable tool that can integrate with numerous external applications. The Vim online platform serves as a hub for the community, where users can share useful tips and tools related to Vim. Additionally, Vim includes a scripting language that facilitates the creation of plugins, enabling IDE-like functionalities, syntax highlighting, colorization, and other advanced capabilities. These scripts can be easily uploaded and managed through Vim online, providing a seamless experience for users. Originally named Vi IMitation, Vim has evolved so significantly that the name change to Vi IMproved was deemed necessary. In essence, Vim incorporates nearly all of the commands from the traditional Unix program "Vi," while also offering a host of enhancements. This powerful editor is ideal for both novice and experienced users seeking a reliable text editing solution.

Claude Code is a developer-focused AI tool built to actively assist with real-world coding tasks inside the tools engineers already use. Instead of only completing lines of code, it understands full features, repositories, and workflows. Developers can run Claude Code from their terminal, IDE, Slack, or browser to ask questions, make changes, or debug issues. It automatically explores codebases to provide context-aware explanations and recommendations. This makes onboarding to new projects significantly faster and less error-prone. Claude Code can refactor large sections of code, run tests, and help resolve issues without jumping between platforms. It supports integrations with GitHub, GitLab, and common CLI utilities for end-to-end development workflows. Teams can use it to turn issues into pull requests with minimal manual effort. Claude Code is included in Anthropic’s Pro and Max plans with varying usage limits. Overall, it helps developers focus more on decision-making and less on repetitive implementation work.

Establish meaningful B2B relationships. Use an intuitive cold email tool to reach out and follow-up across channels. You can be confident in your delivery. Unique algorithm that uses human behavior to deliver 100% messages to your main inbox. Only send to verified email addresses. This is done automatically and in real-time. People will appreciate personalized messages. Follow up using the best channel. Automated measurement of campaign success. Our AI-powered system analyzes all replies and shows how many were positive. Get a clear view of how effective your strategy.

Codex is an advanced AI coding assistant from OpenAI that helps developers streamline the entire software development process from start to finish. It functions as a powerful pair programmer capable of understanding repositories, writing code, and generating production-ready pull requests. The platform supports complex workflows, including debugging, refactoring, testing, and code reviews, all within a unified environment. One of its standout features is computer use, which allows Codex to operate your computer directly by seeing the screen, clicking, and typing within applications. This capability enables it to interact with tools and software that lack direct integrations or APIs. Codex also includes an in-app browser, allowing developers to iterate on web applications and provide precise instructions directly on live pages. It integrates with a wide range of tools and plugins, enhancing its ability to gather context and take action across workflows. The platform supports multi-agent collaboration, enabling parallel work across projects to accelerate development timelines. Codex also offers automation features that allow it to schedule and complete recurring tasks without manual input. With memory capabilities, it can remember preferences and past actions to improve future performance. Overall, Codex delivers a comprehensive AI-powered solution that combines coding, automation, and real-world computer interaction to boost developer efficiency.

Semaphore stands out as the only CI/CD platform that offers robust, ready-to-use support specifically designed for monorepo projects. With the Visual Pipeline Builder, every team member can engage in the CI/CD process seamlessly, eliminating the need for undocumented, manual build configurations. Say farewell to uncertainty and welcome a dependable continuous delivery experience! As the fastest CI/CD service available, Semaphore empowers you to advance your projects significantly, offering adaptable pricing structures without any hidden user fees. Experience a streamlined approach without the clutter of unnecessary tools. With meticulously crafted environments tailored for each technology stack, Semaphore enables teams to efficiently build, test, and deploy applications. Rather than leaving you to navigate the complexities of CI/CD alone, we pledge our unwavering support throughout your journey, backed by a proven history of success. And with our dedication, you can trust that you are in capable hands at every turn.

Harbor is an open-source container registry that focuses on security and compliance. It enhances the basic functionality of a Docker registry by adding features like: Vulnerability Scanning: Checks images for known security weaknesses before deployment. Role-Based Access Control: Manages who can access and modify images based on roles and permissions. Image Signing: Digitally signs images to ensure authenticity and prevent tampering. Replication: Enables syncing images between multiple Harbor instances for disaster recovery or distributed deployment. Harbor is not a silver bullet for all container security challenges, but it addresses a crucial aspect: protecting your images from vulnerabilities and ensuring they're used in a controlled manner. It's particularly beneficial for organizations with strict security and compliance requirements.

Devtron serves as an AI-driven, Kubernetes-centric DevOps platform that aims to streamline and integrate the entire application delivery lifecycle, infrastructure oversight, and operational tasks within a singular control interface. By merging essential DevOps functionalities, including CI/CD, GitOps, security measures, observability, cost oversight, and debugging tools, it removes the hassle of juggling various disjointed tools and dashboards. This platform functions as a unified control layer for Kubernetes settings, empowering teams to deploy, monitor, manage, and resolve issues with applications across multi-cloud or on-premises clusters, all while ensuring comprehensive visibility and governance. Additionally, it features Kubernetes-native CI/CD pipelines with no-code workflows, orchestration across multiple environments, approval-based deployments, and reusable templates, facilitating quicker and more dependable software delivery while minimizing manual tasks. Thus, organizations can achieve greater efficiency and consistency in their development processes.

Experience DefectDojo firsthand by checking out its demo and logging in using sample credentials provided. Available on GitHub, DefectDojo comes with a convenient setup script to facilitate installation, and there's also a Docker container featuring a pre-built version of the tool. You'll be able to pinpoint exactly when new vulnerabilities arise in a build or are addressed. Using DefectDojo's API, tracking the timing of security assessments on products is straightforward, allowing you to monitor security tests conducted on each build seamlessly. This powerful platform enables the tracking of crucial details such as build-id, commit hash, branch or tag, orchestration server, source code repository, and build server associated with every security test performed on demand. Additionally, it offers a variety of reports covering tests, engagements, and products. By organizing products into categories of critical importance, you can focus on those that matter most to your organization. Furthermore, DefectDojo provides the capability to consolidate similar findings into a single entry, helping developers manage issues more effectively and reducing clutter in their reports. This streamlined approach enhances the overall security management process and aids in prioritizing remediation efforts efficiently.

Deploy the open-source buildkite-agent within your own environment for optimal speed, enhanced control, and robust security. This agent is responsible for checking out your source code, executing tailored hooks and overrides, and subsequently carrying out your build tasks, ensuring that your source code remains securely on your own infrastructure. You can easily install the agent via a variety of packages and binaries compatible with numerous platforms and architectures, such as Ubuntu, Debian, Mac, Windows, Docker, and many others. With its artifact and metadata storage capabilities, the agent facilitates share-nothing, state-free build jobs that can be effortlessly distributed and scaled across multiple agents. You have the flexibility to run as many build agents as you require (up to 10,000 connected per account), all while maintaining smooth operations. The open-source Elastic CI Stack for AWS provides a straightforward method to maintain a scalable CI stack that adapts to your needs within your own AWS account. Alternatively, if you prefer a more personalized approach, you have the option to leverage the tools with which you are already familiar in your production environments, such as Packer and Terraform, allowing for a seamless integration of your existing workflows. This adaptability ensures that your CI/CD processes can evolve alongside your project requirements.

Concourse serves as an open-source tool designed for continuous automation, effectively streamlining processes through its foundational elements of resources, tasks, and jobs, making it particularly suitable for CI/CD applications. Its pipeline functions similarly to a distributed, ongoing Makefile, where each job outlines a build plan that specifies input resources and the actions to take upon their changes. The web UI visually represents your pipeline, allowing users to seamlessly navigate from a job failure to understanding the underlying issues with just a single click. This visualization acts as a "gut check" feedback mechanism: if something appears off, it likely warrants attention. Additionally, jobs can be linked through dependency configurations, creating an interconnected graph of jobs and resources that perpetually advances your project from the initial codebase to deployment. All aspects of configuration and management are handled via the fly CLI, with the fly set-pipeline command being used to upload the configuration to Concourse. Once you confirm that everything is set up correctly, you can then commit the configuration to your source control repository, ensuring that your automation remains aligned with your project's evolving needs. This flexibility and clarity make Concourse an invaluable asset for developers looking to enhance their continuous integration and delivery workflows.

Leverage the expressive capabilities of well-known programming languages to outline your application resources and speed up the development process. Streamline your onboarding experience with AWS by utilizing constructs that automatically configure cloud resources with established defaults. Create and disseminate reusable components that align with your organization's security, compliance, and governance standards. You can construct applications, compose runtime code, and define resources all within your integrated development environment (IDE). By employing familiar programming languages, you can specify your cloud application resources effectively. The AWS Cloud Development Kit (AWS CDK) enhances cloud development by enabling the modeling of your applications using common programming languages. Using AWS CDK as your primary framework allows for more efficient application development and the definition of cloud infrastructure as code, facilitating smoother migration of intricate backend infrastructure while seamlessly integrating with continuous integration and delivery (CI/CD) pipelines. This approach not only boosts productivity but also ensures a more organized and manageable development cycle.

We are excited to unveil Zora, a revolutionary marketplace designed for the buying, selling, and trading of exclusive limited-edition products. Each of these products is represented as a token, with prices fluctuating according to market supply and demand; the more interest an item garners, the higher its price rises, and the opposite is true as well. This system of dynamic pricing allows early buyers of sought-after items to resell them at a profit, even prior to receiving the actual product, and those who stay ahead of trends can transform their curation skills into tangible financial gain. Furthermore, users have the opportunity to purchase fractional shares of an item, enabling them to speculate on its future value, while creators can engage their communities by allowing them to buy and trade these goods before they are manufactured. This innovative approach ensures that creators can capture the full value of their work by selling their products at a dynamic price, empowering enthusiasts to invest in the ideas and merchandise of their favorite creators right from the early stages of development. Overall, Zora not only fosters a unique trading environment but also bridges the gap between creators and their supporters, facilitating a collaborative marketplace where art and commerce converge seamlessly.

ActiveState delivers Intelligent Remediation for vulnerability management, which enables DevSecOps teams to not only identify vulnerabilities in open source packages, but also to automatically prioritize, remediate, and deploy fixes into production without breaking changes, ensuring that applications are truly secured. We do this by helping you: - Understand your vulnerability blast radius so you can see every vulnerabilities’ true impact across your organization. This is driven by our proprietary catalog of 40M+ open source components that’s been built and tested for over 25 years. - Intelligently prioritize remediations so you can turn risks into action. We help teams move away from alert overload with AI-powered analysis that detects breaking changes, streamlines remediation workflows, and accelerates security processes. - Precisely remediate what matters - unlike other solutions, ActiveState doesn’t just suggest what you should do, we enable you to deploy fixed artifacts or document exceptions so you can truly drive down vulnerabilities and secure your software supply chain. The ActiveState platform centers on open source languages packaged as runtimes that can be deployed in various form factors. Low-to-no CVE container images are also available for plug-in and play needs.

Kyverno serves as a policy management engine tailored for Kubernetes environments. It enables users to handle policies as Kubernetes resources without the need for a new programming language, allowing for the use of standard tools such as kubectl, Git, and Kustomize to oversee policy management. With Kyverno, users can validate, mutate, and generate Kubernetes resources while also safeguarding the supply chain of OCI images. The CLI tool provided by Kyverno is particularly useful for testing policies and validating resources within a CI/CD pipeline. Additionally, Kyverno empowers cluster administrators to independently manage configurations specific to different environments, while promoting the enforcement of best practices throughout their clusters. Beyond just managing configurations, Kyverno can also examine existing workloads for adherence to best practices or actively enforce compliance by blocking or altering non-conforming API requests. It is capable of using admission controls to prevent the deployment of non-compliant resources and can report any policy violations discovered during these operations. This functionality enhances the overall security and reliability of Kubernetes deployments.

ZEST Security presents an innovative platform for risk resolution that harnesses the power of AI to transform cloud risk remediation specifically for security teams. In contrast to conventional security measures that simply point out vulnerabilities, ZEST takes a proactive approach by linking the appropriate team to the necessary solutions, thus shortening the duration from vulnerability identification to effective remediation. This comprehensive platform ensures full remediation coverage by juxtaposing the intended DevOps configuration with the current cloud runtime environment, facilitating effortless detection and addressing of risks in both managed and unmanaged cloud settings. With automated root cause analysis, the platform accurately identifies the source of issues, down to specific assets and lines of code, enabling teams to tackle multiple challenges with minimal adjustments. Furthermore, the AI-driven risk resolution pathways significantly shorten the mean time to remediation and remove the need for manual triage through the application of dynamic remediation techniques. As a result, security teams can respond to threats more swiftly and efficiently than ever before.

Archipelo serves as a comprehensive platform for managing developer security posture, assisting organizations in protecting their software development lifecycle (SDLC) by delivering instantaneous insights on developer activities, the utilization of AI coding tools, and governance of those tools. Among its key features is Developer Detection Response (DevDR), which enables proactive identification and reduction of security vulnerabilities, alongside Automated Tool Governance designed to curb shadow IT occurrences. Additionally, the AI Code Usage & Risk Monitor helps maintain secure coding standards by tracking software development activities. By effortlessly integrating into CI/CD pipelines, Archipelo not only captures developer actions but also produces actionable insights that bolster security measures, reduce risks, and ensure adherence to compliance throughout the software development journey. This makes Archipelo an essential element for organizations aiming to enhance their security framework in a rapidly evolving technological landscape.