.

security/scanning/vulnerability-scanning/assets/trivy-config.yaml

@@ -0,0 +1,70 @@
+# Trivy Configuration
+# Place in project root or ~/.trivy.yaml
+
+# Scan settings
+scan:
+  # Scanners to use
+  scanners:
+    - vuln
+    - secret
+    - config
+  
+  # Severity levels to report
+  severity:
+    - CRITICAL
+    - HIGH
+    - MEDIUM
+
+# Vulnerability settings  
+vulnerability:
+  # Ignore unfixed vulnerabilities
+  ignore-unfixed: true
+  
+  # Vulnerability types
+  type:
+    - os
+    - library
+
+# Secret scanning settings
+secret:
+  config: trivy-secret.yaml
+
+# Misconfiguration settings
+misconfiguration:
+  # Policy paths (custom OPA policies)
+  policy:
+    - ./policies
+
+# Cache settings
+cache:
+  # Cache directory
+  dir: /tmp/trivy-cache
+  
+  # Cache TTL in hours
+  ttl: 24h
+
+# Database settings
+db:
+  # Repository for vulnerability database
+  repository: ghcr.io/aquasecurity/trivy-db
+
+# Output settings
+format: table
+output: ""
+
+# Exit code when vulnerabilities found
+exit-code: 0
+
+# Ignore specific files
+skip-files:
+  - "**/*_test.go"
+  - "**/test/**"
+
+# Ignore specific directories
+skip-dirs:
+  - node_modules
+  - vendor
+  - .git
+
+# Custom ignore file
+ignorefile: .trivyignore.yaml