trivy Nine Compliance Specs Hidden in the Binary Trivy 0.73.0 ships nine compliance specs compiled into the binary — CIS for AWS, Docker, EKS, Kubernetes and RKE2, plus NSA and both Pod Security Standards profiles. Nothing in the help output tells you their names.
trivy Exit Codes Are the Cheapest Gate You Will Ship One flag decides whether a Trivy scan blocks a pipeline. On the same image, --severity CRITICAL exits 0 and HIGH,CRITICAL --ignore-unfixed exits 1 — and the gate that actually fires is the one that costs 115 milliseconds.
