Trivy is used in the CI after building our Docker image. It scans the Docker image and our dependencies for known vulnerabilities. The docker-make image is a simple docker:latest containing make.
See https://gitlab.hpi.de/codeocean/codemoon/poseidon/-/issues/44.