Runtrace scans installed software, project dependency metadata, executable metadata, and selected sensitive-asset locations on enrolled Macs. Findings are created for a specific security condition, not merely because a file or package exists.
Vulnerable software
- Installed developer tools and package-manager software whose uploaded ecosystem and exact version match an OSV advisory. The hosted service enriches CVE matches with CISA KEV and FIRST EPSS evidence when those feeds are available.
- Project dependencies from supported npm, PyPI, Cargo, and Go manifests or lockfiles that match an OSV advisory.
- Packages identified as malicious by advisory metadata.
Software updates
- Homebrew formulae and casks with a newer version are shown as routine software updates, separate from known vulnerabilities.
- An available update does not become a vulnerability unless the installed version also matches a published security advisory.
Dependency install behavior
- npm dependencies recorded with install lifecycle scripts are reported under Install Script Review.
- Project manifests declaring preinstall, install, postinstall, or prepare hooks are reported without uploading the script body.
- package-lock.json and other lockfiles are inventory sources. Their presence alone is not a vulnerability and is not labeled as supply-chain risk.
Sensitive assets
- SSH private keys and private signing-key material in scanned developer paths.
- Cloud credential files and Kubernetes configuration metadata.
- Environment files, PKCS #12 archives, provisioning profiles, PEM keys, and related signing material outside suppressed fixture paths.
Runtrace records the asset type and safe location metadata. It does not upload key contents, secret values, or document contents.
Executables
- Unsigned executable files and scripts found in configured developer workspaces.
- Gatekeeper-quarantined executables in scanned roots.
- Installed binaries with a package identity and version that match a supported vulnerability advisory.
Applications and containers
- macOS application bundles are inventoried with their bundle version, bundle identifier, and signing identity. Runtrace does not yet inspect embedded frameworks or packages, so an application record is not presented as vulnerability-checked.
- Local Docker images are inventoried with repository, tag, and image ID. Runtrace does not yet inspect image layers, operating-system packages, or language packages inside the image, so an image record is not presented as vulnerability-checked.
Evidence and remediation
Each finding includes category, severity, confidence, affected package or safe path, evidence summary, and remediation guidance. Vulnerability findings include advisory identifiers, installed and fixed versions, aliases, CVSS data, CISA KEV status, FIRST EPSS probability, and malicious-package indicators when available. Remediation uses the relevant package manager where possible and ends with a rescan to verify the fix.
Noise controls
Known test fixtures and public certificate stores are suppressed. Business and Enterprise organizations can add allowlists that match a package, path, advisory, or category, require a reason, and may include an expiration date. Suppressed records remain available in audit history and exports.
Coverage limits
Advisory coverage depends on upstream ecosystem data. Software without a supported advisory source can still appear in inventory without a CVE match. Runtime process provenance from Apple's Endpoint Security framework is not part of the standard non-privileged agent.