Use for any question or task about scanning infrastructure code for misconfigurations with one tool, including Kubernetes manifests, Terraform, CloudFormation, Helm, ARM and Dockerfiles that run as root, or migrating off tfsec: trivy config with severity gating, .trivyignore suppressions, custom Rego checks and SARIF for GitHub code scanning. Legacy tfsec is in its references.