Trace Documentation

Welcome to the Trace documentation. This site covers how a Trace penetration test works, how to connect it to the systems your team already uses, and how to work with it from the command line.

Start here

• Getting Started: What Trace does, who it's for, and how onboarding works.
• Pentest Overview: How a Trace whitebox pentest finds, verifies, and reports vulnerabilities.

Pentest

How Trace tests your applications and what you get back.

• Pentest Overview: Whitebox testing, verified findings, and where they show up.
• Verified Findings: How Trace validates findings against your live stack to dramatically cut false positives.

Integrations

Connect Trace to the systems your team already uses.

• GitHub: Connect your org by installing the Trace GitHub App on the repositories you want tested.
• Bitbucket: Connect a Bitbucket Cloud workspace as a source for engagements.
• AWS: Read-only cloud inventory via a cross-account IAM role.
• Vercel: Read-only inventory through Vercel's native integration.
• Linear: Create tickets from pentest findings and sync remediation status back automatically.

Security

How Trace protects your data and how your team controls access.

• How Trace Handles Your Data: Protections applied to source code, findings, and reports.
• Access Control: SSO, SCIM, roles, audit log, and GitHub App permissions.

For compliance attestations and audit reports, visit our Trust Center.

CLI

Use the Trace CLI to authenticate, set up pentest targets, and review findings directly from your terminal.

• CLI Overview: Install, global options, and the auth, org, setup, repo, and pentest commands.