Getting Started

Trace is an AI-native security company that runs whitebox penetration tests on your applications. You connect your source, point Trace at an application, and Trace tests it the way an attacker would, with full read access to the code, so it can find and confirm real attack paths instead of guessing from the outside. Every finding is reviewed by a security expert and delivered audit-ready for SOC 2 and similar regimes.

This page walks through what Trace does, who it's for, and what happens when your organization is onboarded.

What Trace does

Trace clones your repository into an isolated, ephemeral environment and reads the actual code (the auth model, the data flows across files and services, the business logic), then uses that understanding to find and exploit vulnerabilities. Because it works from the inside out, it reaches the issues a black-box test never sees:

• Broken access control: IDOR, missing authorization checks, cross-tenant isolation gaps, privilege escalation.
• Injection: SQL, command, and template injection reachable through real request paths.
• Business-logic flaws: multi-step abuses that only make sense once you can read both the request and the handler behind it.
• Authentication & session weaknesses, SSRF, insecure design, and the rest of the web attack surface.

Every finding is verified before it reaches you: Trace substantiates the attack vector, exploit scenario, prerequisite access, and impact with code citations, and a security expert reviews it. Findings reach your team through the dashboard, the CLI, and your notification channels. For a deeper look, see the Pentest Overview.

Who Trace is built for

• AppSec engineers and CISOs who need a real pentest with defensible, audit-ready evidence for SOC 2, ISO 27001, and similar regimes.
• Engineering teams who want to fix genuine, exploitable issues, not triage a wall of scanner noise.

How onboarding works

Trace onboarding is hands-on. The Trace team runs the first engagement alongside you and calibrates scope before you rely on the output.

The flow looks like this:

1. Account provisioning. We provision your organization in WorkOS and invite your initial admins. SSO (SAML, OIDC, Google, Microsoft) and SCIM provisioning can be wired up at this stage.
2. Connect your source. From the dashboard, you'll install Trace's GitHub App (or connect a Bitbucket workspace) and select which repositories to grant access to. GitHub's install screen lists every permission Trace requests, and we publish a complete reference on request for security review.
3. Define the target. You set up the application under test: its environment(s) and the credentials Trace should authenticate with. Optionally connect a cloud integration (AWS or Vercel) so an engagement can see how the app is actually deployed. You can do this from the dashboard or the CLI.
4. Run the pentest. Trace runs the engagement against the scope you defined, verifies each finding, and a security expert reviews the report before it lands.
5. Remediate and re-test. Work findings in the dashboard, ship fixes, and Trace re-tests to confirm each one is actually closed.

Pentests are manual: Trace never starts an engagement automatically. Testing runs only when you (or the Trace team) explicitly kick it off, against the scope you choose.