A security assessment platform should withstand more scrutiny than any other vendor in your stack. This page explains how GhostTrace is built — including, deliberately, the things it does not do yet.
GhostTrace does not generate authorization — it consumes yours. Your signed engagement letter or rules of engagement becomes a hard allowlist, and the platform cannot exceed it.
Scope is established outside the platform — engagement letter, MSA, or rules-of-engagement document, signed by the responsible owner. That authorization is encoded as the scope allowlist for the run. No paper, no probes.
A single shared authorization function is the source of truth, called independently by the API that accepts the scan, the worker that executes it, and the engine's HTTP boundary before any request leaves. If the check can't complete, the request is denied. No layer can be bypassed.
Every decision — allow or deny — is written to the scope ledger with the target and the rationale. Mid-run, an operator can remove targets but the platform refuses to add any; widening requires re-authorization. Audit the ledger after any run.
A platform that actively probes systems must be impossible to misdirect. Each control prevents a failure we've thought about explicitly.
Enforcement lives wherever a request can originate — API, scan worker, request layer — through one shared function. A misconfigured detector cannot escape the allowlist, and any check that can't complete becomes a denial, not an exception.
Every run has a hard ceiling you agree to up front, so it can never become a runaway bill or an endless assessment. Hit the ceiling and the run stops cleanly, everything already proven still delivered. In deterministic mode, AI calls are blocked in code — your "no AI" decision is enforced, not promised.
Before anything real happens, the platform shows the operator exactly what it will do — which detectors, which surface, what scope — and waits for approval. An operator's misunderstanding never becomes a live incident.
Findings are gate-verified, adjudicated, and delivered without a human bottleneck. Every capability invocation and scope decision lands in the ledgers, so you can reconstruct exactly what happened after the fact — review is available to you, never required of you.
Assessment data is among the most sensitive data a vendor can touch. We hold as little of it as possible, isolate what we hold at the database layer, and offer full physical isolation when you need it.
Delivered as a hosted service — nothing to install, just a browser and an authorized scope. Your data is isolated at the database layer, so one tenant's queries can never read another's rows. For regulated or data-residency needs, a dedicated single-tenant instance keeps all storage in an environment you control. When the AI brain is on, LLM calls go to the model provider; you can run deterministic-only with zero external AI calls.
Raw response bodies are retained in evidence bundles for proven findings only; non-proven candidates don't keep full bodies. What remains is the audit trail — findings, evidence, ledgers — because that's what your team needs to act.
API keys and database credentials are injected at runtime from a managed secrets store, never committed; automated secret scanning runs on every commit. Proof-replay subprocesses run with a restricted environment, so platform credentials are never exposed to reproduction commands.
The application connects to its database through a non-privileged role constrained by row-level isolation. Access boundaries are a database guarantee, not an application-code promise.
Every engagement is bounded by signed rules of engagement before any technical work begins — whether you run a single scoped assessment or, with design partners, a continuous cadence.
Scope, auth paths, testing windows, and escalation contacts are agreed and signed off — including your CISO's sign-off — before the engine is pointed anywhere.
The authorized targets become the allowlist. Anything outside it is denied at three independent layers and logged — by construction, not by configuration.
Before real probing, you see exactly what will happen: which detectors, against which surface, under what scope. The run proceeds only after the preview is approved.
The engine maps, probes, and proves within the authorized scope. Every capability invocation and every scope decision lands in the ledgers; you can watch the live trace and halt at any time.
Findings are autonomously gate-verified, adjudicated, and reported — no human bottleneck in the loop. You receive the evidence bundles — self-contained, independently verifiable — plus the full artifacts with JSON and CSV exports, and a one-click executive report (rolling out).
Run it once for a point-in-time assessment, or — rolling out with design partners — on a continuous cadence that re-proves what changed. Every re-run stays inside the same signed scope, and you get deltas between runs (new, resolved, reopened), not another full dump to triage.
Most vendors hide their limitations in a contract appendix. We'd rather you plan around them from day one — nothing on this list should ever be a surprise mid-engagement.
Authenticated testing probes behind the login today when credentials are provided for the engagement. Turnkey SSO (OAuth, SAML) and vault-resolved credentials — so we never hold a long-lived secret — are rolling out with design partners, not yet self-serve.
Replaying the live trace of a completed run and per-scan pickers on some views are near-term roadmap items. Everything the views show is already in the run artifacts — these are quality-of-life additions, not data gaps.
The IDOR detector works on numeric identifiers today; UUIDs, slugs, and hash-style IDs are on the roadmap. Many modern APIs use non-numeric IDs the detector will catch later, not yet.
Ticketing, SIEM, and vulnerability-management tools consume our structured artifacts (results.json) directly. A polling API and webhook push for real-time integration are on the near-term roadmap, prioritized by design-partner demand.
GhostTrace is a product of CySecTrust Inc. SOC 2 is in preparation; engagement-level controls — signed ROE, fail-closed scope enforcement, complete audit ledgers, entitlement-bounded execution — are in effect today. In one calibrated run, the scope governor logged 2,738 allowed and 542 denied requests with zero unauthorized widenings.
Found something in GhostTrace itself? We practice what we preach — write to [email protected] and include the evidence. We'll respond within one business day.
The full technical & commercial reference, the verification-discipline and standing-rules documentation, the honest-limits appendix, and rules-of-engagement templates are available on request, under NDA where appropriate.