Trivy EP12 | Scan Git Repositories with Trivy 🔍 | Full Repo Audit for Secrets & Vulnerabilities

Welcome to Episode 12 of the Trivy Security Scanner Complete Course. In this chapter, we explore how to perform a comprehensive security audit of entire Git repositories—covering local clones and remote GitHub repositories without cloning—to detect vulnerabilities, exposed secrets, misconfigurations, and infrastructure-as-code (IaC) issues.

1. Why Do We Need Repository-Level Scanning?

Status Quo & The Problem

In earlier phases of our DevSecOps journey, we focused heavily on securing individual container images and scanning isolated file systems on local machines. While effective for shift-left testing before pushing code, this approach leaves blind spots once code enters version control systems like GitHub.

Consider a common production scenario:

• Developers push code updates daily across multiple branches.
• Configuration files, environment files (.env), API keys, passwords, and tokens accidentally get committed.
• Third-party library dependencies (Java, Python, Go, Node.js) accumulate CVE vulnerabilities over time.
• Infrastructure-as-Code (Terraform, Kubernetes manifests, CloudFormation) contains misconfigurations.

The Solution: trivy repo

To address these challenges, Trivy provides the trivy repo command. It allows security engineers and developers to scan an entire Git repository in a single command, evaluating everything from hardcoded secrets to dependency libraries and IaC files.

2. Core Mental Model: The All-Seeing Security Auditor

Real-Life Analogy: Think of trivy repo as an automated security auditor walking through a massive corporate office building. Instead of inspecting just one desk (a single file or container image), the auditor checks every filing cabinet, hidden drawer, safe, and visitor logbook across all rooms and floors simultaneously—identifying forgotten passwords on sticky notes, outdated locks on doors, and unsecured documents.

What Does trivy repo Scan?

3. Trivy Repo vs. Other Trivy Scanners

To understand when to use trivy repo, let us compare it with other scanning modes available in Trivy.

4. Scenario 1: Scanning a Local Git Repository

When a repository has already been cloned to your local workstation, you do not need to use trivy fs. You can directly invoke the repository scanner pointing to your current working directory.

Step-by-Step Execution

1. Navigate inside your cloned repository terminal directory.
2. Execute the trivy repo command using . to represent the current directory:

trivy repo .

Filtering by Severity

To focus only on critical issues that require immediate remediation, use the --severity flag:

trivy repo --severity CRITICAL .

5. Scenario 2: Scanning a Remote GitHub Repository (Without Cloning)

One of Trivy's most powerful capabilities is scanning a remote GitHub repository directly via its URL, eliminating the need to clone or download the source code locally.

Choosing a Target: OWASP WebGoat

To demonstrate remote repository scanning, the instructor uses WebGoat—a deliberately insecure web application maintained by OWASP, designed to teach web application security lessons and demonstrate common server-side application flaws.

Executing the Remote Scan with Severity Filtering

To scan the remote WebGoat repository and filter for high-severity vulnerabilities, run:

trivy repo --severity HIGH https://github.com/WebGoat/WebGoat

Understanding the Output Report

When the scan completes, Trivy updates its vulnerability database, iterates through every file and manifest in the remote repo, and renders a structured report on your screen:

• Vulnerability Count: Identifies exact counts (e.g., 23 vulnerabilities of severity HIGH).
• Package Details: Pinpoints the vulnerable library or package name.
• Installed Version vs. Fixed Version: Clearly displays the currently installed vulnerable version (e.g., version 1.4.5) and recommends safe upgrade versions (e.g., upgrading to version 1.4.9 or the latest 1.4.18).

6. Integrating Repository Scanning into CI/CD Pipelines

Beyond manual terminal checks, trivy repo is designed for automated DevSecOps pipelines.

Automated Monthly & PR Audits

• CI/CD Integration: Run trivy repo as part of your GitHub Actions workflow or GitLab CI pipeline upon pull requests or scheduled cron jobs.
• Secret Leak Detection: Catch exposed API tokens and passwords before merge requests are approved.
• Compliance Reporting: Run monthly repository audits to track how many secrets or high-severity CVEs have been introduced or resolved over time.

7. Summary and Key Takeaways

• Comprehensive Repository Audits: The trivy repo command scans entire GitHub directories for security vulnerabilities, infrastructure-as-code flaws, and exposed secrets.
• No Clone Required: You can scan remote GitHub repositories directly by passing the repository URL to Trivy without needing a local clone.
• Local Repo Support: For already-cloned repositories, running trivy repo . provides a thorough audit of the local working tree.
• Severity Filtering: Use the --severity flag (e.g., --severity CRITICAL or --severity HIGH) to filter noise and focus strictly on high-priority remediation.
• Actionable Version Guidance: Trivy vulnerability reports explicitly show the installed version alongside recommended fix versions for quick patching.
• Secret Detection: Trivy inspects codebases for hardcoded credentials, passwords, API keys, and .env files.
• Pipeline Ready: trivy repo integrates seamlessly into CI/CD workflows for automated monthly scans and pull request gatekeeping.