Shift-Left Security Scanning with Trivy

By Techworth Labs

Find hardcoded credentials, vulnerable dependencies and insecure infrastructure code in a real repository before any of it reaches production.

Browse

Skill Level: Intermediate Duration: 45 min SecurityDevSecOps

Free to browse. Takes about 45 minutes once you start.

Lab Overview

The Shopfront team is about to ship their checkout service. Nobody has run a security scan over it yet.

In this lab you take the role of the engineer adding security scanning to the pipeline. Working on a real checkout out repository, you will use Trivy to find three classes of problem that routinely reach production: credentials committed to source control, dependencies with known CVEs, and infrastructure-as-code that exposes data to the internet.

Everything runs locally on the lab machine. There is no cloud account and nothing you do here can affect real infrastructure.

What to Expect

Environment: a single Ubuntu machine you connect to over SSH, with Trivy and a sample repository already installed.
Access: SSH credentials are generated for your session and shown in the workspace. They are destroyed when the lab ends.
Offline: the vulnerability database is bundled into the machine, so scans return in seconds and need no internet access.
Progress: your work is not saved. If the lab expires or you quit, the machine and everything on it is destroyed.

Learning Objectives

Successfully complete this lab by achieving the following learning objectives.

1 Detect credentials committed to source control

Scan a repository for hardcoded secrets and explain why deleting the line does not remove the credential.

2 Identify dependencies with known vulnerabilities

Scan pinned Python dependencies against the CVE database and read off the fixed version an upgrade would need to reach.

3 Catch insecure infrastructure as code before it is applied

Find and fix a publicly readable S3 bucket and a security group open to the internet, then prove the finding is resolved by re-scanning.

Lab History

You have not attempted this lab.

What are hands-on labs?

A lab is a real environment, not a simulation. You get a live machine with the tooling already installed, a task taken from production work, and root access to take it apart. Nothing is mocked, nothing is multiple choice. It either works or it doesn't.

Real tooling

The same commands you would run at work, on a machine that is already set up for them. No screenshots, no sandboxed toy version.

Break it freely

Everything is disposable. When the clock runs out the environment is destroyed with everything in it, so there is no reason to be careful.

Useful on Monday

Built by engineers who run these systems in production. Skills you can apply to your own stack the same week, not exam preparation.

Browse labs