Trace the risk.
Act with context.

Scan source code, investigate running applications and review existing SAST findings. Inspect the evidence, assign the work and track the decision.

Find your starting point

Request a demo Explore the platform

One platform. Different ways in.

Security work doesn’t
start in just one place.

Start with code, a running application, or the findings you already have. Choose the assessment, inspect its evidence and follow the work through remediation.

TraceMint / Platform indexSix ways to investigate.

A guide to the platform—not a scan in progress. Each workflow keeps its own scope and evidence.

Connected to the way your team builds.

Explore SCM integrations

Different surfaces.
One deeper look.

Explore code security

exports.pyPython · async

01async def export_link(request, exports, cache):
02    user = request.user
03    key = f"export:{request.export_id}"
04    if cached := await cache.get(key):
05        return cached
06    record = await exports.get(
07        request.export_id, workspace=user.workspace_id
08    )
09    link = await exports.sign(record, expires_in=60)
10    await cache.set(key, link, ttl=60)
11    return link

Follow both paths

Cache hit · early returnreturn cached

Cache miss · workspace checkuser.workspace_id

The check exists. The fast path skips it.

Authorize every request. Scope cached links to the workspace.

Example assumptionsAuthenticated user; shared cache; ownership enforced by exports.get; signed links act as bearer credentials.

members.controller.tsTypeScript · NestJS

01@UseGuards(SessionGuard)
02@Patch(':id')
03async update(
04  @Param('id') id: string,
05  @Body() body: Record<string, unknown>,
06  @Req() req: RequestWithUser,
07) {
08  const member = await this.members.inTeam(id, req.user.teamId);
09  return this.members.update(member.id, body);
10}

Follow the update

Member lookup · team scopereq.user.teamId

Update fields · request inputbody

The member is scoped. Which fields can change?

Allowlist editable fields. Give role changes their own permission check.

Example assumptionsThe member lookup enforces team scope. The update service and any global field validation are not shown.

InvoiceController.javaJava · Spring

01@GetMapping("/invoices")
02List<Map<String, Object>> search(
03    @RequestParam String customer,
04    @AuthenticationPrincipal User user
05) {
06    String sql = "SELECT id, total FROM invoices "
07        + "WHERE team_id = ? AND customer = '"
08        + customer + "'";
09    return jdbc.queryForList(sql, user.teamId());
10}

Follow query construction

Team value · bound parameteruser.teamId()

Customer value · added to SQLcustomer

One value is bound. Another becomes query text.

Bind customer input as a parameter too. Keep values out of SQL structure.

Example assumptionsSpring JDBC binds the team value. Customer input reaches this query without a separate restrictive allowlist.

FilesController.csC# · ASP.NET

01[Authorize]
02[HttpPost("files")]
03public async Task<IActionResult> Upload(
04    IFormFile file, string folder)
05{
06    var root = storage.ForTeam(User);
07    var path = Path.Combine(root, folder, file.FileName);
08    await using var output = System.IO.File.Create(path);
09    await file.CopyToAsync(output);
10    return Ok();
11}

Follow the destination

Starting folder · team scoperoot

Destination · supplied folder + namefolder, file.FileName

A team root does not contain every combined path.

Validate the folder and generate file names. Enforce containment and protect against symlink escapes.

Example assumptionsBoth folder and filename are untrusted. The storage directory is writable; no additional path policy is shown.

remote_resource.goGo · net/http

01func fetchRemote(w http.ResponseWriter, r *http.Request) {
02    target := r.URL.Query().Get("url")
03    res, err := http.Get(target)
04    if err != nil {
05        http.Error(w, "Remote resource unavailable", 502)
06        return
07    }
08    defer res.Body.Close()
09    io.Copy(w, io.LimitReader(res.Body, 4096))
10}

Follow the outbound request

Response size · boundedio.LimitReader

Request target · user suppliedhttp.Get(target)

The response is bounded. The destination is not.

Allowlist destinations and redirects. Validate and connect to the same resolved address.

Example assumptionsThe URL is user-controlled; the default client can reach the target. No egress policy is shown.

invoices.rsRust · Axum

01async fn invoice(
02    State(db): State<Db>,
03    Path(id): Path<Uuid>,
04) -> Result<Json<Invoice>, (StatusCode, String)> {
05    db.invoice(id).await.map(Json).map_err(|err| {
06        tracing::error!(%err, "invoice lookup failed");
07        (StatusCode::INTERNAL_SERVER_ERROR,
08         err.to_string())
09    })
10}

Follow the error

Internal record · application logtracing::error!

Client response · raw detailerr.to_string()

One error takes two different exits.

Keep diagnostic detail in restricted logs. Return a generic error with a reference ID.

Example assumptionsThe handler uses Axum’s error response conversion. Exposure depends on the contents of the database error.

ThumbnailController.phpPHP · Laravel

01public function thumbnail(Request $request)
02{
03    $data = $request->validate([
04        'image' => ['required', 'string'],
05    ]);
06    $input = $data['image'];
07    $command = 'convert ' . $input . ' -resize 96x96 png:-';
08    $bytes = shell_exec($command);
09    return response($bytes, 200)
10        ->header('Content-Type', 'image/png');
11}

Follow the argument

Input check · string type'string'

Execution · shell commandshell_exec($command)

A string check is not a shell boundary.

Avoid shell interpolation. Pass validated file paths as separate process arguments.

Example assumptionsValidation checks type, not a file allowlist. shell_exec and ImageMagick are enabled on the host.

webhooks_controller.rbRuby · Rails

01class WebhooksController < ApplicationController
02  skip_before_action :verify_authenticity_token
03  def payment
04    payload = request.raw_post
05    event = JSON.parse(payload)
06    Payments.mark_paid(event.fetch("invoice_id"))
07    head :ok
08  rescue JSON::ParserError
09    head :bad_request
10  end
11end

Follow the webhook

Body check · valid JSONJSON.parse(payload)

State change · invoice paidPayments.mark_paid

Valid JSON says nothing about who sent it.

Verify the provider signature over the raw body. Reject replayed events.

Example assumptionsNo inherited signature-verification callback is shown. The payment helper changes invoice state.

ContinueHandler.cppC++ · HTTP service

01Response continueTo(const Request& req) {
02    const auto user = sessions.find(req);
03    if (!user) {
04        return Response::unauthorized();
05    }
06    const auto next = req.query("next");
07    const auto target = next.value_or("/dashboard");
08    auto response = Response::status(302);
09    response.setHeader("Location", target);
10    return response;
11}

Follow the redirect

Session check · signed in!user

Next location · supplied URLsetHeader("Location", target)

The session is checked. Where does the user go next?

Resolve and validate the destination against the same application origin. A leading slash alone is not enough.

Example assumptionsSynthetic HTTP helpers: query returns an optional string and setHeader stores the supplied Location.

reports.jsJavaScript · Express

01app.get("/reports/:id", requireUser,
02  async (req, res) => {
03    const report = await reports.get(req.params.id);
04    if (report.teamId !== req.user.teamId) {
05      audit.warn("report access denied", req.user.id);
06    }
07    const link = await storage.sign(report.objectKey);
08    res.json({ url: link });
09  },
10);

Follow execution

Access mismatch · recordedaudit.warn

Execution continues · link signedstorage.sign

A denied check still needs to stop the response.

Return a denial before signing or sending an object link.

Example assumptionsAuthentication ran upstream. audit.warn only logs; storage.sign issues a bearer link without a team check.

Shared cache. Signed links. One skipped boundary.Illustrative examples · not live scans

Why TraceMint

Keep your scanners.
Choose your model.
Inspect the decision.

Bring context to the tools you already use, with model choice and reasoning your team can review.

See the approach

01 / Understand the system

See the application.
Not a wall of files.

A repository has structure. Architecture turns AI-based analysis into an explorable view of components, scopes and inferred relationships—with source references a click away.

Explore Architecture

A better starting point

Move from the whole system
to the part that matters.

SystemScopeComponent

Navigation concept, not a scan result.

02 / Investigate the finding

Less jumping between tools.
More useful review.

Large reports can turn false-positive review into hours of manual work. Bring supported Checkmarx, Fortify or SARIF reports into TraceMint: the AI reviews the configured scope autonomously, records its reasoning and leaves your team in control of the final action.

See autonomous triage

Source

Where the finding points.

Evidence

What supports the assessment.

Decision

What your team does next.

Keep credentials out of code.

Secret scanning with masked findings and scan history.

Look beyond your own code.

Dependencies, artifacts and the evidence behind a release.

03 / Make it fit your environment

Your infrastructure.
Your model choice.

Compare deployment paths

SaaS

Use TraceMint as a hosted service, with onboarding scoped to your repositories, workflows and data requirements.

On-premises

Run in your environment with your own LLM or a TraceMint-provided LLM deployment.

TraceMint Research

Security is in the details.

Notes on public advisories and credited contributions to open-source security.

All research

TwentySSRF

A redirect is a new trust decision

An HTTP client checked the first destination, but not the destinations reached through redirects. The gap allowed authenticated users to bypass private-address restrictions.

CVE-2026-27023Read the case study

HoppscotchAuthorization

An object ID is not an authorization check

Personal environment operations did not consistently bind the target object to its owner. Knowing another user's environment ID could enable unauthorized access or modification.

CVE-2026-28216Read the case study

ArcaneCommand execution

When update metadata becomes executable

Container lifecycle labels supplied executable commands to the updater. A lower-privileged user could prepare metadata that ran when an administrator initiated an update.

CVE-2026-23520Read the case study

Research subjects, not customer endorsements. Credits and original advisories are linked in each note.

Plan your evaluation

Start with the questions
that matter to your team.

Tell us what you want to evaluate. Our team will review your request and contact you to agree the scope and arrange a time.

Request a demo

Trace the risk.
Act with context.

Security work doesn’t
start in just one place.

AI Code Security

AI Pentesting

Secret Scanning

Supply Chain Security

Architecture

Autonomous Triage

Different surfaces.
One deeper look.

Keep your scanners.
Choose your model.
Inspect the decision.

See the application.
Not a wall of files.

Less jumping between tools.
More useful review.

Source

Evidence

Decision

Keep credentials out of code.

Look beyond your own code.

Your infrastructure.
Your model choice.

SaaS

On-premises

Security is in the details.

A redirect is a new trust decision

An object ID is not an authorization check

When update metadata becomes executable

Start with the questions
that matter to your team.

Trace the risk.Act with context.

Security work doesn’tstart in just one place.

AI Code Security

AI Pentesting

Secret Scanning

Supply Chain Security

Architecture

Autonomous Triage

Different surfaces.One deeper look.

Keep your scanners.Choose your model.Inspect the decision.

See the application.Not a wall of files.

Less jumping between tools.More useful review.

Source

Evidence

Decision

Keep credentials out of code.

Look beyond your own code.

Your infrastructure.Your model choice.

SaaS

On-premises

Security is in the details.

A redirect is a new trust decision

An object ID is not an authorization check

When update metadata becomes executable

Start with the questions that matter to your team.

Trace the risk.
Act with context.

Security work doesn’t
start in just one place.

Different surfaces.
One deeper look.

Keep your scanners.
Choose your model.
Inspect the decision.

See the application.
Not a wall of files.

Less jumping between tools.
More useful review.

Your infrastructure.
Your model choice.

Start with the questions
that matter to your team.