Trust center

RuntraceLast updated July 24, 2026

Runtrace provides software inventory and vulnerability management for macOS developer workstations. This page describes the product boundary and the controls applied to hosted customer data.

Data handling

The agent uploads structured device and software inventory metadata plus local security signals needed to operate the service. The hosted service performs vulnerability matching and stores the resulting advisory evidence.
Runtrace does not upload source code, file contents, secret values, private-key contents, shell history, screenshots, clipboard contents, or arbitrary command output.
Dependency manifests and lockfiles are parsed on the device. Only package names, ecosystems, versions, safe source locations, and related security metadata are uploaded.
Customer data is not sold or used to train general-purpose machine learning models.

Identity and access

Hosted administrator access uses OIDC, role-based authorization, server-side sessions, httpOnly cookies, and CSRF protection.
Administrative access is scoped to the customer's organization unless a platform operations role is explicitly assigned.
Device enrollment uses organization-scoped enrollment tokens. Enrolled devices authenticate with individual device credentials.
Security-sensitive administrative actions are recorded in the audit history.

Remote scan safeguards

Administrators can request default, full-disk, or approved custom-root scan profiles. Runtrace does not send shell commands to agents.
Scan requests have file limits, expire after 24 hours, and allow only one active scan per device.
Custom roots are validated against scanner policy and reject private, temporary, system, and device paths that are outside the product boundary.
Requested, claimed, completed, failed, and expired scan states are auditable.

Structured remediation safeguards

Remediation is limited to typed npm global, pipx, Cargo, Go, and Homebrew package updates derived from a current affected inventory record. Project dependency files are not changed automatically.
The agent rejects unrecognized action types, unsafe package identifiers, unexpected target devices, stale findings, and package managers outside trusted installation paths. It never receives a shell command.
npm remediation disables lifecycle scripts. Package-manager output is discarded rather than uploaded. Jobs expire after 24 hours and allow one active remediation per device.
A job is marked verified only after a fresh inventory upload is analyzed centrally and no longer reports the targeted package and vulnerability. Queueing, claiming, execution, failure, cancellation, and verification are audited.

Vulnerability intelligence

Runtrace matches exact package ecosystem and installed version data against OSV advisories where that ecosystem is supported.
CVE matches are enriched with CISA Known Exploited Vulnerabilities status and FIRST EPSS probability. Advisory identifiers, aliases, CVSS data, fixed versions, and authoritative malicious-package indicators are stored when available.
A lockfile is an inventory source, not a vulnerability by itself. Runtrace creates a finding only when package metadata matches an advisory or a separate security condition, such as an install lifecycle script, is detected.
Findings can be marked fixed, accepted risk, or false positive with notes and audit history. Organization allowlists require a reason and may expire.

Service protection and recovery

Hosted customer state is stored in PostgreSQL and protected by tenant-scoped authorization.
Hosted production environments must use backups outside the application process and pass an isolated restore test before customer data is accepted.
Current backup and restore-test evidence can be reviewed during a customer security assessment.
Service incidents and planned maintenance are communicated on the public status page.
Agent packages distributed to customers are signed and notarized for macOS.

Product limitations

The agent is currently macOS-first. Linux and Windows workstation support are not included in the standard product.
Vulnerability coverage depends on the quality and ecosystem coverage of upstream advisories. Software without a supported advisory source may appear as inventory without a CVE match.
macOS application bundles are currently inventoried by bundle version and signing identity, but their embedded components are not yet scanned for vulnerabilities.
Docker images are currently inventoried by repository, tag, and image ID, but image layers and operating-system packages are not yet scanned for vulnerabilities.
The agent needs permission to read each configured scan root. macOS privacy controls can limit coverage until the required permission is granted.
Runtrace provides vulnerability evidence and remediation guidance. Optional remediation jobs execute only the documented allowlisted package-manager actions; arbitrary commands are not supported.