User data flow documentation

[bnomis]

Description

I couldn't find documentation on how or if any user data (source code etc.) flows over the network when using Trivy. For example, does Trivy send any user data to a server for analysis or is it all local?

Link

No response

Suggestions

I suggest adding a page to the documentation to make the data flow clear and explicit.

[knqyf263]

For example, does Trivy send any user data to a server for analysis or is it all local?

It Is processed locally in standalone mode.

[itaysk]

Just to clarify: Snyk is a commercial SaaS product, Trivy is an open source scanning tool. So the motivation for a doc page is entirely different. We could add an FAQ item but honestly I'm not sure many will encounter it.

Also, I noticed you call this tool Aqua which is a different thing: Aqua is also a commercial SaaS product that is powered by Trivy. Some differences are covered here

[bnomis]

I was using Aqua to mean "the organisation behind Trivy"

[AnaisUrlichs]

Hi @bnomis thank you for clarifying and your input, I will create a PR in the next days to provide more details/make it easier to find the information in the docs

[alatalo]

I was looking for the same information from the docs and could not find the mentioned links (under Docs > References > Modes >). I suggest a topic in FAQ with a clear Privacy title. Now that I would've found in a few seconds :)

[AnaisUrlichs]

Hi @alatalo the Aqua Enterprise produce is disconnected from the open source tool Trivy. This is similar to the relationship many companies have with ArgoCD, they use and build on ArgoCD but they are not a default extension of Argo.

While many of the core maintainers of Trivy are employed or affiliated with Aqua, it is not connected to the commercial product. Aqua does not know who is using Trivy where and why, different to other free or semi-open source projects. We have a disclaimer in README https://github.com/aquasecurity/trivy
Please let us know if you are missing information.