Core warning: access to the Docker socket is effectively host-level access. Run Tracebag only on a host you control and never expose its port directly to an untrusted network.
Default protections
- Tracebag binds to
127.0.0.1and requires authentication by default. - Login work is size-bounded and rate-limited per client, while authenticated mutations require a CSRF token.
- The application emits a reviewed CSP, frame denial, MIME-sniffing protection, a restrictive referrer policy, and HSTS over HTTPS.
- Containers remain invisible until they carry the configured opt-in label.
- The browser cannot submit shell commands, arbitrary Docker requests, image names, mounts, or output paths.
- Diagnostic operations use fixed profiles with duration, concurrency, storage, and daily limits.
- Temporary runners have networking disabled and are removed after the operation.
- Full process dumps require a global switch, a target label, and exact per-request confirmation.
Diagnostic data is sensitive
Logs, traces, stack snapshots, GC dumps, full dumps, and incident exports can contain credentials, personal information, request data, and business secrets. Tracebag stores data locally, but the operator controls access, retention, backup, and deletion.
Remote access
Keep the application on localhost and terminate HTTPS through a trusted reverse proxy. Trust forwarded headers only from the proxy's exact address or controlled network, restrict access at the network layer, and do not publish PostgreSQL.
External services
Analysis runs locally. Tracebag does not send evidence to external analysis providers.
Report a vulnerability
Do not include real logs, traces, dumps, secrets, or customer data in a public issue. Use GitHub's private vulnerability reporting channel for the repository.
Report privately