TRUSTIVAN does not detect vulnerabilities. It uses Trivy, an open-source scanner developed by Aqua Security under the Apache License 2.0, and everything it builds sits above that. This page exists because the distinction has practical consequences. It decides which project’s documentation answers your question, which project to report a bug to, and what your obligations are if you redistribute anything.

​
Where the line falls

Detection is treated as a commodity, deliberately. It is behind a contract — a single adapter package is the only code in TRUSTIVAN permitted to import the upstream engine, and a CI guard fails the build if anything else does. That boundary exists so the engine can be replaced without touching anything above it. A scanner that leaked its types throughout the codebase would be a dependency rather than a component. What TRUSTIVAN owns is what happens to a finding once it exists: its identity across scans, its lifecycle and triage history, suppression with a recorded reason, the policy engine and its verdicts, tenancy, the machine API, webhooks and the dashboard. The short version: upstream tells you a CVE is present; TRUSTIVAN remembers that someone accepted the risk on Tuesday, and does not ask again tonight.

​
Which documentation answers your question

These docs cover TRUSTIVAN. They do not restate upstream’s documentation, and where a question is genuinely upstream’s they say so rather than paraphrasing an answer that would go stale. The last two rows are the pair worth internalising. “This CVE should have been found” is a detection question. “This CVE was found and I cannot see it” is a TRUSTIVAN question, and usually has a lifecycle answer.

​
What TRUSTIVAN does not expose

TRUSTIVAN embeds the engine as a library rather than shelling out to it, so:
  • There is no upstream command line to pass flags to, and no passthrough.
  • The configurable surface is exactly what Scanning and concurrency and Vulnerability database document. An upstream option not listed there is not reachable.
  • Engine identifiers are internal and are stripped before anything reaches an API response. Do not build against them.
If you need an upstream capability TRUSTIVAN does not expose, that is a feature request for TRUSTIVAN, not a configuration problem.

​
Attribution, and what it requires of you

The Apache-2.0 licence requires that upstream’s attribution travel with any redistribution. TRUSTIVAN reproduces it verbatim in the NOTICE file shipped with the product:
Misconfiguration policies from trivy-checks are covered separately, by the MIT licence, © 2024 Aqua Security. They are compiled into the binary, so every build that includes misconfiguration scanning is a copy and carries that notice too. If you redistribute TRUSTIVAN or a container image containing it, these notices must go with it. Keep NOTICE in the image and do not strip it. The complete per-component inventory — every Go module and npm package, with versions and detected licences — is generated into legal/THIRD_PARTY_NOTICES.md and legal/third-party-inventory.json, and regenerated with make legal-inventory. The public summary is at trustivan.com/open-source.

​
Trademarks

Apache-2.0 grants no trademark rights, and none are claimed here. TRUSTIVAN is not affiliated with, endorsed by, or sponsored by Aqua Security. “Trivy” and “Aqua Security” are trademarks of their respective owners, and are used here only to identify the software TRUSTIVAN builds on — which is the accurate thing to do, not a marketing association. The vendored upstream source is kept unmodified, including its own branding. A CI guard fails the build if upstream identity is stripped out of it, because removing attribution to make the product look more self-made would breach the licence that permits using it at all.

​
Vulnerability data

The advisory data behind a finding is aggregated from public feeds — the National Vulnerability Database, GitHub Security Advisories, OSV, and the security trackers of the major Linux distributions. That data’s licensing is distinct from the licence of the code that packages it, and its redistribution terms differ per source. If you plan to redistribute scan results as a dataset, rather than use them operationally, that is a question to put to your own counsel. Using TRUSTIVAN to scan your own images and act on the results is not affected.