Security

Understand what TraceDojo protects, what runs on your machine, and how to handle sensitive test data.

Your agent runs in your environment

The hosted dashboard stores and displays test reports. It does not execute uploaded customer adapters. Local adapters run with the permissions of your process, including its filesystem, environment, and network access. Only run adapters you trust.

Account and project access

Sign-in uses a one-time email code. Hosted requests check account identity and project ownership. Database row-level policies provide an additional ownership boundary.

Project upload tokens are stored as hashes and can expire or be revoked. They allow uploads to one project; they do not grant permission to read or delete reports.

Handle reports as application data

Reports can contain prompts, tool inputs, outputs, and simulated state. Pattern-based redaction catches recognized secrets, but cannot reliably remove every credential or piece of personal information. Use synthetic fixtures and review reports before uploading or sharing them.

What a passing test means

A passing simulation provides evidence about a specific scenario. It is not a security certification or a guarantee of production behavior. TraceDojo is not an operating-system sandbox for hostile code.

TraceDojo does not currently offer SSO, customer-configurable retention, or a published compliance attestation. No independent security certification is claimed.

Report a concern

See Contact for the current support channel. Do not include passwords, API keys, customer reports, or exploit details in an initial message. Describe the affected area and request a private follow-up. Do not test against other customers or their data.