# Trace Documentation (/docs)



Welcome to the Trace documentation. This site covers how a Trace penetration test works, how to set up the applications you want tested, how to connect it to the systems your team already uses, and how to work with it from the command line.

Start here [#start-here]

* [Getting started](/docs/getting-started): What Trace does, who it's for, and how onboarding works.
* [Pentest overview](/docs/pentest/overview): What a Trace pentest covers, and how it finds, verifies, and reports vulnerabilities.
* [Setting up applications](/docs/pentest/applications): Pick the right application type, link the right repositories, and add environments and credentials.

Pentest [#pentest]

How Trace tests your applications and what you get back.

* [Pentest overview](/docs/pentest/overview): What Trace tests, whitebox through blackbox, and where findings show up.
* [Setting up applications](/docs/pentest/applications): How many applications to create, which type to pick, and what each one needs.
* [How an engagement works](/docs/pentest/engagement): From scoping to the final report, fixing findings, and disputing one.
* [Verified findings](/docs/pentest/verified-findings): How Trace validates findings against your live stack to dramatically cut false positives.

Integrations [#integrations]

Connect Trace to the systems your team already uses.

* [GitHub](/docs/integrations/github): Connect your org by installing the Trace GitHub App on the repositories you want tested.
* [Bitbucket](/docs/integrations/bitbucket): Connect a Bitbucket Cloud workspace as a source for engagements.
* [AWS](/docs/integrations/aws): Read-only cloud inventory via a cross-account IAM role.
* [GCP](/docs/integrations/gcp): Read-only inventory of your Google Cloud projects, folders, or organization.
* [Vercel](/docs/integrations/vercel): Read-only inventory through Vercel's native integration.
* [Convex](/docs/integrations/convex): Connect a Convex project so Trace can test your live deployments.
* [Linear](/docs/integrations/linear): Create tickets from pentest findings and sync remediation status back automatically.
* [Code size](/docs/integrations/code-size): How Trace counts billable lines of code, and how to reproduce the number.

Security [#security]

How Trace protects your data and how your team controls access.

* [How Trace handles your data](/docs/security/data-handling): Protections applied to source code, findings, and reports.
* [Access control](/docs/security/access-control): SSO, SCIM, roles, audit log, and GitHub App permissions.

For compliance attestations and audit reports, visit our [Trust Center](/trust).

CLI [#cli]

Use the Trace CLI to authenticate, set up pentest targets, and review findings directly from your terminal.

* [CLI overview](/docs/cli/overview): Install, global options, and the `auth`, `org`, setup, `repo`, and `pentest` commands.