TraceBadger scans your code, compiled Java and dependency trees, then shows your analysts exactly how each risk was found. They decide. Every decision is recorded, and the report is ready for the client.
In development. Pilot places are open for a small number of teams.
A small team in Romania builds TraceBadger. NIS2 and the Cyber Resilience Act shaped the product from the start.
We wrote the analysis engine ourselves. It doesn't wrap another vendor's tool, so we can explain every finding and fix the engine when it is wrong.
Built on open advisory data (OSV, CISA KEV, FIRST EPSS), open-source libraries and library models, and open formats like CycloneDX, SPDX and SARIF. Your results are never locked in.
Each assessment lives in its own workspace. You move through the same six steps every time, and the report only unlocks once its blockers are cleared.
Upload a repository archive, SBOMs and existing scanner reports.
Trace data flows in code and resolve the full dependency tree.
See where each finding came from and why it was raised.
Analysts accept, reject or mark false positives. Each choice is audited.
Weigh findings with exploit signals and fix availability.
Produce the client report, a work plan and SBOM or VEX exports.
When a scan cannot see something, TraceBadger says so. Missing metadata, unresolved versions and analysis limits are shown as gaps, never as proof that the code is safe.
Follows user input to SQL queries, shell commands, file paths, outbound URLs, deserialization, XML parsers, redirects and HTML output.
Resolves direct and transitive dependencies from build files and lockfiles without running your build, then matches them against open advisories.
Bring in the SBOMs and scanner results you already have. Export clean files your clients and their tools can read.
We scan public, deliberately vulnerable Java projects at a fixed commit and count a hit only when the alert lands on the right vulnerability with the right CWE. Our own team measured these figures in October 2026. They are development results, not independent validation.
An earlier strict run (build d02fad7) flagged 11 of 1,325 safe cases: false-positive rate 0.83%, score 99.2, precision 99.2%.
The engine was developed against this benchmark.These label sets are small (3 to 41 vulnerabilities), so treat them as rough. We show recall only for these projects. Other tools' published figures use different counting rules, so we don't print them next to ours.
Triage choices, exports and settings changes create audit events you can review later.
Each client gets its own organization and workspaces. Nothing crosses between them.
Reports and exports leave out source code, secrets, tokens and uploaded document content.
Multi-factor sign-in with passkeys or an authenticator app, plus recovery codes.
Your clients' customers are asking about supply-chain security. TraceBadger maps the evidence you already produced to what they ask for, and shows the gaps plainly.
An evidence matrix links your SBOMs, findings, scanner summaries, remediation backlog and audit trail to NIS2 and DORA application evidence. Export it as CSV, PDF or a machine-readable index.
Keep a register of products and exact releases, record manufacturer review, and track vulnerability reporting cases against their deadlines with drafts ready for review.
Map findings and scope to the current OWASP references, so the client sees which controls have evidence and which do not.
Check SBOM quality and provenance, and prepare inputs for the client's own SSDF self-attestation.
TraceBadger helps you gather and map evidence. It does not certify compliance and does not give legal advice. Your analysts and your client's advisers make those calls.
TraceBadger is a hosted service. Use it with your own team, or have our consultants run the assessment with you. Pilot teams help shape what we build next.
Tell us about your team and the applications you assess.
pilot@tracebadger.eu