Skip to main content
Trivy is a security scanner that finds misconfigurations and exposed secrets in Infrastructure as Code (IaC) files. CodeRabbit runs Trivy version 0.74.0.

​
Files

Trivy runs only on files matching these patterns:
  • Terraform: *.tf, *.tf.json, *.tofu, *.tofu.json
  • Docker: Dockerfile, Dockerfile.*, *.dockerfile
  • Kubernetes: k8s/**/*.yaml, k8s/**/*.yml, kubernetes/**/*.yaml, kubernetes/**/*.yml, manifests/**/*.yaml, manifests/**/*.yml
  • Helm: helm/**/*.yaml, helm/**/*.yml, charts/**/*.yaml, charts/**/*.yml, Chart.yaml, values.yaml, values.yml
  • CloudFormation: *.template.json, *.template.yaml, *.template.yml, cloudformation/**/*.json, cloudformation/**/*.yaml, cloudformation/**/*.yml
  • Azure ARM: azuredeploy.json, azuredeploy.parameters.json, arm/**/*.json
  • Docker Compose: docker-compose.yaml, docker-compose.yml, compose.yaml, compose.yml
Non-IaC files (e.g. GitHub workflows, package.json) are excluded.

​
Configuration

Trivy is enabled by default. Enable or disable it with .coderabbit.yaml or the CodeRabbit web UI:
.coderabbit.yaml
CodeRabbit reads and uses trivy.yaml from the repository root.

​
Security policy and restrictions

Trivy runs inside the CodeRabbit sandbox. Repository configuration can suppress findings or reference custom Rego policies, which Trivy evaluates in Open Policy Agent’s sandboxed virtual machine. CodeRabbit fixes the output path and severity flags and does not pass repository-controlled --config, --policy, or --template flags.

​
When we skip Trivy

CodeRabbit will skip running Trivy when:
  • No supported files are changed in the pull request.
  • Trivy is already configured in GitHub Actions, GitLab CI, CircleCI, or Azure Pipelines.

​
Profile behavior

  • Chill: --severity CRITICAL,HIGH
  • Assertive: --severity CRITICAL,HIGH,MEDIUM,LOW,UNKNOWN