Maintainers

This page maps subsystems to the people most likely to know them. Trivy does not have a CODEOWNERS file in the repo, so the data below is derived from git log activity on main and the Aqua Security maintainer roster. Bot accounts (dependabot[bot], github-actions[bot], factory-droid[bot], etc.) are excluded.

For questions about a specific area, mention these people in your issue or PR. For security disclosures, follow SECURITY.md rather than pinging maintainers directly.

Subsystem	Recent contributors (git history)	Last activity
CLI / commands	knqyf263, DmitriyLewen, simar7	within the last month
fanal (file analysis)	knqyf263, DmitriyLewen, afdesk	active
Scan service	knqyf263, DmitriyLewen, simar7	active
Cache	knqyf263, simar7	within the last quarter
Database (pkg/db, pkg/javadb)	knqyf263, DmitriyLewen, afdesk	active
RPC (pkg/rpc, rpc/)	knqyf263, simar7	within the last quarter
IaC engine (pkg/iac/)	nikpivkin, owenrumney, knqyf263	active
Misconfiguration glue (pkg/misconf)	nikpivkin, knqyf263	active
Secret scanning	knqyf263, simar7	within the last quarter
License scanning	knqyf263, DmitriyLewen	within the last quarter
SBOM (pkg/sbom)	knqyf263, simar7, DmitriyLewen	active
VEX (pkg/vex)	knqyf263, DmitriyLewen	active
Kubernetes (pkg/k8s)	chenk, knqyf263, nikpivkin	active
Plugin (pkg/plugin)	knqyf263, simar7	within the last quarter
WebAssembly modules (pkg/module)	knqyf263	within the last 6 months
Helm chart (helm/)	simar7	active
Release / release-please / goreleaser	simar7, knqyf263	active
GitHub Actions / CI (.github/workflows/)	simar7, knqyf263	active
Documentation site (docs/)	knqyf263, simar7, community contributors	active

Project leads

• Teppei Fukuda (knqyf263) — original author of Trivy. Maintainer of fanal and the overall codebase. Final reviewer for cross-cutting changes.
• Owen Rumney (owenrumney) — original author of tfsec/defsec, now folded into pkg/iac/. Primary IaC reviewer.
• Nikita Pivkin (nikpivkin) — IaC engine and misconfiguration scanner.
• Simar Khurana (simar7) — release pipeline, CI, SBOM, Helm chart.
• DmitriyLewen — language analyzers and vulnerability detector tweaks.
• afdesk — OS detectors and DB plumbing.
• chenk — Kubernetes scanner.

Communication

• GitHub issues — bug reports and feature requests.
• GitHub Discussions — general questions, architectural debates.
• Slack — Aqua maintainers staff a public channel; see trivy.dev/community for the invite.
• SECURITY.md — security reports.

How to become a maintainer

The Trivy project follows the standard CNCF-style path: sustained, high-quality contributions over time, plus active participation in code review and issue triage. The current maintainers will reach out when someone is ready to be invited.