Trivy can assess dependencies and build environments used by mobile projects. Distinguish the selected scan mode from the components it actually examines.
Evaluation approach
Supported target types determine package and configuration findings. Do not assume every embedded or native mobile component will be recognized automatically.
Application example
Scan Android build containers and CI configuration to support the integrity of the environment producing the protected package.
Limits and considerations
Review each CVE's relationship to the installed component and reachable code path.
Define the analysis target
A repository scan does not amount to a complete analysis of the final APK or IPA. State which filesystem, dependencies or other supported targets were inspected.
Investigate impact using the actual component, version and reachable code. Record database freshness. Prioritize new, reachable and consequential findings rather than relying only on the total vulnerability count.
Checks and decisions
- Keep vulnerability data current
- Assess reachability
- Version exceptions
Trivy addresses supply-chain and infrastructure risk. It is distinct from mobile runtime protection.
Sources
The primary references above provide the technical basis. Example workflows and evaluation suggestions are this publication’s explanations, not independent test results for a particular product.