CoreTrace

CoreTrace develops an open source security analysis toolchain for C and C++ code. The tool combines static analysis, dynamic analysis, and coverage-guided fuzzing to identify vulnerabilities such as buffer overflows, use-after-free errors, race conditions, and stack overflow issues, without requiring code execution for static checks. The product is built as an LLVM-powered ecosystem consisting of over 20 repositories, including a core CLI orchestrator, a Clang-based compiler wrapper, and specialized analyzer modules for stack usage, concurrency, and runtime behavior. It also integrates third-party analyzers such as TscanCode and Apex for binary analysis of PE and ELF formats. CoreTrace provides multiple interfaces for developers, including a command-line interface, a desktop GUI, a VS Code extension, and a browser-based web platform (several of these are still in development). The tool is designed to integrate into CI/CD pipelines through plugins for GitHub Actions, GitLab CI, and Jenkins, allowing teams to block pull requests containing critical vulnerabilities. Reports can be exported in JSON, XML, HTML, or SARIF formats, with SARIF results uploadable to GitHub Code Scanning. The company targets software development teams working with C/C++ codebases who need to detect memory safety and concurrency vulnerabilities early in the development lifecycle. CoreTrace's code and tools are distributed as open source under licenses such as Apache-2.0, MIT, and GPL-3.0, and are hosted publicly on GitHub.