Trace, the AI
security engineer

The depth of a pentest. The speed of automation.

acme-corpVulnerabilities

Run Scan

Open Vulnerabilities

on default branch

Critical

vulnerabilities

High

vulnerabilities

Medium & Low

2 medium, 1 low

Showing 8 of 8 vulnerabilities

IDTitleTypeRepoCWEFound

Open5

In Progress1

Fixed2

Everything you need to secure
your applications

All in one, without the noise.

Static Analysis

Understands complex business logic and traces data across microservices to find vulnerabilities that rule-based scanners miss.

TRC-032Second-order SQL injection

User input is sanitized on write but trusted when read from the database in a different service.

acme/apidatabaseacme/reports

41async function generateReport(userId: string) {

42 const user = await db.users.findById(userId);

43 return db.raw(`SELECT * FROM reports WHERE author = '${user.name}'`);

44}

Secrets Detection

Follows how secrets flow through your code and systems. Validates which credentials are still live and surfaces the exposures that actually matter.

Supply Chain

Analyzes your dependency tree and identifies which vulnerable packages are actually reachable from your application code.

lodash@4.17.19

Critical

Prototype pollution via merge()

Fix: ≥4.17.21·CVE-2021-23337

Reachability path

lodash@4.17.19

merge()

express@4.18.2

body-parser middleware

src/app.ts

line 14 — app.use(bodyParser.json())

src/routes/users.ts

line 47 — _.merge(defaults, req.body)

PR Reviewer

Catches security issues in pull requests before they reach production. Runs on every commit.

feat: add user search endpoint#247

claudecodepusheda1f3c2d

claudecodepushede7b9a01

Some checks were not successful

1 failing, 4 successful checks

Lint (pull_request)

Successful in 10s

Test (pull_request)

Successful in 24s

Type Check (pull_request)

Successful in 17s

Trace Security Scan

2 issues detected

Vercel

Deployment has completed

Verified Vulnerabilities

Coming soon

Runs the exploit against your application locally or on a staging stack you provide, and captures a recorded proof of the vulnerability.

Worklog

Cloning repository

Trace, the AI
security engineer

Everything you need to secure
your applications

Static Analysis

Secrets Detection

Supply Chain

PR Reviewer

Verified Vulnerabilities

Integrates with
your entire stack

Audit-ready pen tests
for SOC 2, ISO 27001, or HIPAA

Trace, the AIsecurity engineer

Everything you need to secureyour applications

Static Analysis

Secrets Detection

Supply Chain

PR Reviewer

Verified Vulnerabilities

Integrates withyour entire stack

Audit-ready pen testsfor SOC 2, ISO 27001, or HIPAA

What does the pen test cover?

Is this suitable for SOC 2, ISO 27001, or HIPAA?

Is it fully automated or manually reviewed?

How fast do I get my report?

What do I need to prepare?

Trace, the AI
security engineer

Everything you need to secure
your applications

Integrates with
your entire stack

Audit-ready pen tests
for SOC 2, ISO 27001, or HIPAA