# authorship: generated by API Evangelist tooling. Stamped 2026-08-18
# on the file's own generator header (roadmap#64). An unmarked file is
# NOT assumed to be ours -- absence of evidence was never stamped.
method: generated
vocabulary:
  name: Trivy Vocabulary
  description: >-
    Domain vocabulary for Trivy, the open-source security scanner from Aqua Security,
    covering vulnerability scanning, misconfiguration detection, secret detection,
    SBOM generation, and Kubernetes security assessment concepts.
  version: 1.0.0
  created: '2026-05-03'
  modified: '2026-05-03'
  tags:
    - Security
    - Vulnerability Scanning
    - Containers
    - Kubernetes

terms:
  - term: CVE (Common Vulnerabilities and Exposures)
    definition: >-
      A reference database of publicly known information security vulnerabilities and
      exposures. Trivy uses CVE IDs as the primary identifier for detected vulnerabilities.
    category: Security
    tags:
      - Vulnerability
      - Security

  - term: Vulnerability Report
    definition: >-
      Trivy's structured JSON output containing all detected vulnerabilities for a
      scanned artifact, organized by target layers. As a Kubernetes CRD (VulnerabilityReport),
      it is auto-generated by Trivy Operator for each workload.
    category: Report
    tags:
      - Reports
      - Vulnerability

  - term: SBOM (Software Bill of Materials)
    definition: >-
      A formal inventory of all software components, dependencies, and metadata in a
      software product. Trivy can generate SBOMs in CycloneDX and SPDX formats and
      scan existing SBOMs for vulnerabilities.
    category: Standard
    tags:
      - SBOM
      - Supply Chain

  - term: Misconfiguration
    definition: >-
      An incorrect or suboptimal configuration in infrastructure-as-code (Dockerfiles,
      Kubernetes manifests, Helm charts, Terraform, etc.) that may create security
      risks. Detected by Trivy's misconfiguration scanner.
    category: Scan Type
    tags:
      - Misconfiguration
      - IaC

  - term: Trivy Operator
    definition: >-
      A Kubernetes operator that continuously scans a cluster using Trivy and stores
      results as native Kubernetes Custom Resources (CRDs). Reports include vulnerability
      reports, config audit reports, SBOM reports, and compliance reports.
    category: Kubernetes
    tags:
      - Kubernetes
      - Operator

  - term: CRD (Custom Resource Definition)
    definition: >-
      Kubernetes extension mechanism used by Trivy Operator to store security scan
      results as native Kubernetes objects. CRDs include VulnerabilityReport,
      ConfigAuditReport, ExposedSecretReport, SbomReport, and compliance reports.
    category: Kubernetes
    tags:
      - Kubernetes
      - CRD

  - term: Client/Server Mode
    definition: >-
      A Trivy deployment model where the server maintains vulnerability databases and
      multiple clients submit scan requests to it, avoiding per-client database downloads.
      Server exposes HTTP endpoints at port 4954.
    category: Deployment
    tags:
      - Server
      - Deployment

  - term: SARIF (Static Analysis Results Interchange Format)
    definition: >-
      An OASIS standard JSON format for reporting static analysis tool results. Trivy
      can output results in SARIF format for integration with GitHub Code Scanning
      and other SAST platforms.
    category: Standard
    tags:
      - Output Format
      - CI/CD

  - term: VEX (Vulnerability Exploitability Exchange)
    definition: >-
      A document format used to communicate the exploitability status of known
      vulnerabilities in software products. Trivy supports VEX documents for
      filtering non-exploitable vulnerabilities.
    category: Standard
    tags:
      - Vulnerability
      - Supply Chain

  - term: Secret Scanning
    definition: >-
      Trivy's capability to detect exposed credentials, API keys, tokens, and other
      sensitive data in container images, filesystems, and repositories.
    category: Scan Type
    tags:
      - Secrets
      - Security

  - term: Config Audit Report
    definition: >-
      A Trivy Operator CRD (ConfigAuditReport) that reports Kubernetes manifest
      misconfigurations for a specific workload, checking against built-in and
      custom OPA-based policies.
    category: Kubernetes Report
    tags:
      - Kubernetes
      - Misconfiguration

  - term: Compliance Report
    definition: >-
      A Trivy Operator CRD (ClusterComplianceReport) reporting adherence to
      security standards such as NSA/CISA Kubernetes Hardening Guidance, CIS
      Kubernetes Benchmark, or Pod Security Standards.
    category: Kubernetes Report
    tags:
      - Compliance
      - Kubernetes