> ## Documentation Index
> Fetch the complete documentation index at: https://docs.coderabbit.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Trivy

> CodeRabbit runs Trivy to find misconfigurations and exposed secrets in infrastructure-as-code files.

[Trivy](https://github.com/aquasecurity/trivy) is a security scanner that finds misconfigurations and exposed secrets in Infrastructure as Code (IaC) files. CodeRabbit runs Trivy version 0.74.0.

## Files

Trivy runs only on files matching these patterns:

* **Terraform**: `*.tf`, `*.tf.json`, `*.tofu`, `*.tofu.json`
* **Docker**: `Dockerfile`, `Dockerfile.*`, `*.dockerfile`
* **Kubernetes**: `k8s/**/*.yaml`, `k8s/**/*.yml`, `kubernetes/**/*.yaml`, `kubernetes/**/*.yml`, `manifests/**/*.yaml`, `manifests/**/*.yml`
* **Helm**: `helm/**/*.yaml`, `helm/**/*.yml`, `charts/**/*.yaml`, `charts/**/*.yml`, `Chart.yaml`, `values.yaml`, `values.yml`
* **CloudFormation**: `*.template.json`, `*.template.yaml`, `*.template.yml`, `cloudformation/**/*.json`, `cloudformation/**/*.yaml`, `cloudformation/**/*.yml`
* **Azure ARM**: `azuredeploy.json`, `azuredeploy.parameters.json`, `arm/**/*.json`
* **Docker Compose**: `docker-compose.yaml`, `docker-compose.yml`, `compose.yaml`, `compose.yml`

Non-IaC files (e.g. GitHub workflows, `package.json`) are excluded.

## Configuration

Trivy is enabled by default. Enable or disable it with `.coderabbit.yaml` or the CodeRabbit web UI:

<Tabs>
  <Tab title=".coderabbit.yaml">
    ```yaml .coderabbit.yaml theme={null}
    reviews:
      tools:
        trivy:
          enabled: true
    ```
  </Tab>

  <Tab title="Web UI">
    Go to **Reviews → Tools → Trivy** in your organization or repository settings and toggle Trivy `on` or `off`.
  </Tab>
</Tabs>

CodeRabbit reads and uses `trivy.yaml` from the repository root.

## Security policy and restrictions

Trivy runs inside the CodeRabbit sandbox. Repository configuration can suppress findings or reference custom Rego policies, which Trivy evaluates in Open Policy Agent's sandboxed virtual machine. CodeRabbit fixes the output path and severity flags and does not pass repository-controlled `--config`, `--policy`, or `--template` flags.

## When we skip Trivy

CodeRabbit will skip running Trivy when:

* No supported files are changed in the pull request.
* Trivy is already configured in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.

## Profile behavior

* **Chill**: `--severity CRITICAL,HIGH`
* **Assertive**: `--severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN`

## Links

* [Trivy GitHub Repository](https://github.com/aquasecurity/trivy)
* [Trivy Documentation](https://trivy.dev)