trivy and trufflehog split it 2–2 on popularity and shipping momentum. Stats only — numbers straight from GitHub, no AI verdict.
Find vulnerabilities, misconfigurations, secrets, SBOM in containers, Kubernetes, code repositories, clouds and more
Each axis is scaled to the bigger of the two — the leader always reaches the edge. It shows who leads on each dimension, not by how much; hover an axis (or read the bars) for the real numbers.
Bars are scaled within each row — they compare the two repos on that metric, not across metrics. Size rows (lines of code, open issues, languages) are facts, not victories, so they are never scored. Shipping counts show “—” while GitHub warms its weekly stats cache.
Trivy's stardom vs. Trufflehog's momentum
aquasecurity/trivy dominates on prestige with 36.8k stars and steady annual commits (522), but trufflesecurity/trufflehog is shipping hotter right now—41 releases in four weeks plus a commanding 2.5k forks showing serious adoption velocity. It's a classic popularity-versus-momentum split: Trivy owns mindshare, Trufflehog owns the sprint.
AI-generated from the stats below.