SOCFortress AppVA Update — Aug 2026

Intro

Most vulnerability scanners tell you one thing: which known CVEs are present in your software dependencies. That's essential — but it's only part of the picture. Two of the most common causes of real-world breaches aren't in the CVE database at all. They're a hardcoded AWS key committed three years ago that nobody noticed, and a Dockerfile that runs your production container as root because nobody checked.

AppVA now addresses both.

We've integrated Trivy by Aqua Security as a complementary scanner that runs alongside the existing Syft + Grype pipeline. The result is a single tool that covers three distinct dimensions of application security: software composition analysis, vulnerability detection, and now secret and misconfiguration scanning.

Hardcoded Secrets

Secret leakage is one of the most consistently exploited attack paths in software supply chains. The pattern is predictable: a developer hardcodes a credential during testing, commits it, and either forgets about it or assumes no one will notice. The credential ends up in version history forever, even if the file is later deleted or the value rotated.

The consequences range from unauthorized API consumption to full account takeover, depending on what the leaked credential unlocks. AWS access keys, GitHub tokens, Stripe API keys, database connection strings — all are high-value targets, and all have appeared in public and private repositories.

Traditional SCA tools like Grype don't look for secrets. They match component versions against CVE databases. A SECRET_KEY = "hardcoded_value" in your Django settings file generates no finding, because it isn't a known vulnerability — it's an operational security failure that sits outside the SBOM model entirely.

Misconfigurations

Security misconfigurations in infrastructure-as-code are similarly invisible to CVE-focused scanners. A Dockerfile that runs as root, a Kubernetes deployment with no resource limits, a Terraform S3 bucket with public read access — none of these involve vulnerable software versions, so none of them appear in a Grype report.

Yet misconfigurations are consistently listed among the top causes of cloud security incidents. They're easy to introduce, often go undetected for months, and can be exploited without any knowledge of the application's software dependencies.

How the Integration Works

Trivy was a natural fit for AppVA for two reasons: it's purpose-built for exactly the capabilities we needed, and it cleanly separates its scanner engines so we could add only the ones that genuinely extend AppVA's coverage.

Clean Separation of Concerns

The critical design decision was to invoke Trivy with --scanners secret,misconfig — explicitly excluding vulnerability scanning. CVE detection remains the exclusive domain of Grype, which queries GHSA and NVD via the SBOM produced by Syft. Trivy never touches that domain.

This means:

No duplicate CVE findings
No deduplication logic required
No risk of conflicting severity ratings for the same vulnerability
Each tool does what it does best

The scan pipeline now runs in five phases:

Prepare → Syft (SBOM) → Trivy (secrets + misconfigs) → Grype (CVEs) → Parse & Store

Prepare → Syft (SBOM) → Trivy (secrets + misconfigs) → Grype (CVEs) → Parse & Store

Trivy runs before Grype deliberately: it operates on the source directory or container image directly, not on the SBOM. This lets it catch secrets and IaC issues that exist in the source but wouldn't be represented in an SBOM at all.

Non-Fatal by Design

Trivy is optional and non-blocking. If Trivy fails for any reason — binary issue, timeout, scan error — the scan logs a warning and continues normally to the Grype phase. This design choice matters for reliability: enabling an optional scanner should never risk breaking core vulnerability scan functionality.

Pre-Installed in the Container

Trivy is installed at image build time via its official install script, alongside Syft and Grype. Users don't configure a binary path — they just check a box. This keeps the Settings page clean and consistent with how the other tools are managed.

What Gets Scanned

Secret Detection

When Trivy runs on a source directory or container image, it inspects file contents for patterns matching known credential formats. The rule set covers credentials from major cloud providers, SaaS platforms, and common frameworks:

Cloud providers: AWS access keys and secret keys, GCP service account keys, Azure connection strings
Source control & CI/CD: GitHub tokens, GitLab tokens, CircleCI, Travis CI
Payment & communications: Stripe API keys, Twilio auth tokens, SendGrid keys
Infrastructure: SSH private keys, PGP private keys, SSL private keys
Generic patterns: high-entropy strings in common variable names (SECRET, PASSWORD, TOKEN, API_KEY)

Each finding in AppVA's results shows:

The rule that matched (e.g. aws-access-key-id)
The provider category
Severity (CRITICAL / HIGH / MEDIUM / LOW)
The exact file path and line number
A redacted excerpt of the matching line

The line number and file path together give developers the precise location to remediate — no guessing required.

Misconfiguration Detection

For misconfigurations, Trivy audits infrastructure-as-code files found in the scanned source. What it checks depends on what's present:

Dockerfiles — checks include:

Container running as root (DS002)
Using ADD instead of COPY for local files (DS005)
Pinning image tags rather than using latest
Sensitive environment variables baked into layers

Kubernetes manifests — checks include:

Containers with privileged: true
Missing resource limits (CPU and memory)
hostPID / hostNetwork / hostIPC enabled
Writable root filesystems
Missing readOnlyRootFilesystem

Terraform — checks include:

S3 buckets with public access
Unencrypted EBS volumes or RDS instances
Security groups with unrestricted ingress (0.0.0.0/0)
Missing CloudTrail logging

Helm charts — Kubernetes-level checks applied to rendered templates

Each misconfiguration finding includes a check ID, a human-readable title, a description, the target file, and a PASS/FAIL status.

Where Results Appear

Scan results now include two new counters in the summary row at the top of every scan detail page — Secrets and Misconfigs — alongside the existing components and CVE severity breakdown.

The detail page gains two new tabs that appear only when Trivy ran and produced results:

Secrets tab: filterable table of detected secrets, with severity badges, category, file path, line number, and match preview. The search bar lets you filter by rule ID, file path, or category.

Misconfigs tab: filterable table of misconfiguration findings, with check IDs, severity, titles, target files, types, and status. Click-searchable by check ID or target path.

When Trivy finds nothing — no secrets, no misconfigurations — the tabs don't appear. A clean scan stays clean-looking.

Enabling Trivy

Trivy is disabled by default. To enable it:

Navigate to Settings (admin only)
Find the Trivy (Secret & Misconfiguration Scanner) section
Check Enable Trivy scanning
Click Save Settings

Every subsequent scan will include the Trivy phase. Existing scan history is unaffected.

If you're running AppVA via Docker Compose, pull the new image first:

docker compose pull
docker compose up -d

docker compose pull
docker compose up -d

Trivy is pre-installed in the updated image — no additional configuration required.

A Note on Scope

Trivy's secret and misconfiguration scanning works on source code and infrastructure files. This means:

GitHub, Upload, and Docker repositories: Trivy runs on the cloned directory, extracted archive, or container image layers — wherever the source files live
SBOM Import repositories: Trivy is skipped. An imported SBOM is a structured data file, not source code — there's nothing for secret or IaC scanning to operate on

If your primary use case is SBOM import, the CVE scanning pipeline (Syft + Grype) is unchanged and unaffected.

The Bigger Picture

AppVA's philosophy has always been to bring application security tooling together in a single, self-hosted platform that security teams can run in their own infrastructure without sending data to third-party SaaS services. Trivy integration is consistent with that goal — the scanning is fully local, nothing leaves your environment, and the results are stored in the same database alongside your SBOM and vulnerability data.

The combination of Syft, Grype, and Trivy now covers three of the most important dimensions of application security posture:

Dimension Tool What it finds Software composition Syft Every package, library, and dependency Known vulnerabilities Grype CVEs matched against your SBOM Secrets & misconfigs Trivy Hardcoded credentials, IaC security issues

Together, they give you a more complete picture of where your applications are exposed — without requiring three separate tools, three separate dashboards, or three separate processes to maintain.

AppVA is open-source and self-hosted. Deployment instructions are available at github.com/socfortress/appva-deploy.

Need Help?

The functionality discussed in this post, and so much more, are available via the SOCFortress platform. Let SOCFortress help you and your team keep your infrastructure secure.

Website: https://www.socfortress.co/