Trivy Compromise Scanner March 2026 Incident Review GHSA-69fq-xp46-6x23
March 2026 Workflow Exposure Review

Trace compromised Trivy workflow references across your GitHub estate.

Authenticate with GitHub, choose the organizations or repositories you can already access, and review findings as each repository completes. The scanner follows direct workflow usage, reusable workflows, and script hand-offs that call Trivy.

Coverage Workflow YAML, reusable workflows, and shell entrypoints
Detection Compromised, historically exposed, and unrestored tags
Runtime Streamed findings, in-memory results, privacy-conscious logging
  • Flags compromised `trivy-action` and `setup-trivy` tags.
  • Surfaces findings from direct workflow usage and nested reusable workflows.
  • Shows live progress as repositories complete.
Access Model

Continue With GitHub

Use your own GitHub identity so scans only inspect the organizations and repositories you can already access.

  1. Authorize the app with your GitHub user.
  2. Select member orgs, specific repositories, or one public org.
  3. Watch the incident report populate in real time.
Sign In With GitHub
Disclaimer

This scanner is provided as a convenience only. Findings and enrichment are best-effort, may be incomplete, and are not a substitute for validating upstream advisories, repository history, and your own incident-response process.