Security
Copy for the future /security page. Every claim below describes shipped behavior.
tracebin runs a script on machines we don't own, operated by people who never signed up for our product. That shapes everything below: the design goal is that a reasonably suspicious person can verify what the script does rather than trust us.
How collection is kept honest
Consent before anything runs or uploads. A plain collection run stops at the manifest gate: every collected file is listed with its size and source, and nothing uploads until the customer types an explicit yes. They can exclude individual files first, or decline entirely. Wrapped runs (where the link runs a command first) ask for consent up front, after showing the command and the complete list of what will be collected. If the script cannot reach an interactive terminal to ask, it refuses to proceed rather than assuming consent.
The script is inspectable. It is plain POSIX shell — no binaries, no obfuscation — with its guarantees stated in a comment at the top: collects only the listed items, asks before uploading, never uses sudo, never installs anything. Every link page offers a download-first variant so the script can be read before it is run. Open-sourcing the collector is planned as part of leaving beta; the guarantee today is that every customer already receives the full source of exactly what they run.
Collection is bounded by the spec. The script collects the spec's globs and command outputs, nothing else. The optional file inventory records names, sizes, and modification times of the spec'd directories — never file contents. All staging happens in a temporary directory removed when the script exits.
Collection links
- Tokens are generated with cryptographic randomness and are practically unguessable.
- Each token is scoped to a single bin. A token can never reach any other bin's data.
- Tokens expire — 24 hours, 7 days, or 30 days — and expiry is enforced server-side: an expired link gets an error and nothing else, including mid-run.
- Every token-facing endpoint is rate limited per token.
- The customer never needs an account, so there is no customer credential to phish or leak.
Data path and storage
- Files upload directly from the customer's machine to object storage over HTTPS, using signed URLs that expire in 15 minutes. File contents do not pass through tracebin's application servers.
- Downloads work the same way: short-lived signed URLs (5 minutes), fetched directly from storage.
- Every file is hashed (SHA-256) at collection time, and the manifest — names, sizes, hashes, source paths, exit codes, timestamps — is stored with the run, so both sides can verify what was transferred.
- Teams can bring their own S3/R2 bucket, in which case artifacts for team bins land in storage they control. The bucket's secret access key is stored encrypted with AES-256-GCM, is never displayed again after entry, and is decrypted only at the moment a signed URL is generated.
Account and tenant isolation
- Application data is isolated per user at two layers: row-level security in Postgres, and explicit owner checks in every API route. Team features grant read-only visibility into teammates' team-scoped bins; write access stays with the owner, and leader-only data (per-member statistics, pending requests) is enforced at the API, not just hidden in the UI.
- Sign-in is email and password through Supabase Auth, which stores passwords hashed with bcrypt. Email confirmation is required at signup, and password reset is available.
What we don't have yet
Candor over polish:
- No SOC 2 or third-party audit yet. It is on the roadmap, gated on enterprise demand rather than promised by a date.
- No single sign-on or OAuth sign-in yet.
- tracebin is in beta, run by a small team. We think the architecture above — customer consent, inspectable script, direct-to-storage transfer, scoped expiring tokens — is worth more than a badge at this stage, and we would rather tell you exactly what exists than imply otherwise.
Reporting
Found something? security@tracebin.dev. We read everything and respond to real reports quickly.