Opportunities › AI-powered vulnerability research automation › Proposed app
Leadtrace
Agent-run code review that proves each finding before you write it up
- Score
- 48
- confidence 67
- Evidence
- 13
- items on the page
- Rivals
- 3
- named in sources
- First version
- 35 d
- estimate
- Type
- Desktop app
- PWA: runs in the browser, installs on Mac and Windows
- Market since
- 2012
- Mature market · AI estimate
ScreensConcept
Desktop app: Security researchers review code repositories, run scans, examine evidence, and draft reports—focused desk work with dense information. Sample screens on a computer, in the proposed brand. Their numbers are sample data.
New job
Runner online- Repositoryvault-core
About this appAI proposal
Leadtrace helps security researchers and bounty hunters cover more code. You point it at a repository, and a set of agents look for suspicious paths, try to reproduce each lead in a sandbox, and keep only what they can show working.
Every finding arrives with the code path, the steps that triggered it, and a draft report shaped for the program you choose. You review, edit and submit it yourself. Nothing is sent without you.
It is built for people who work alone or in small teams and care where their code goes. Run the worker on your own machine or server and bring your own model keys. The web app is the control room for jobs, evidence and drafts.
- Tagline
- Follow every lead. Report only what holds up.
- Voice
- PreciseCalmDirect
- Why this name
- A lead is a hunter's first clue and a trace is the path to it. Together they say: follow the clue until you can prove it.
In the first version
Members say which features they would use. It tells PWAS what people want; it changes no score.
Lead hunting across a repository
Agents read the code, map entry points and rank the paths most likely to hold a flaw, so you start with a short list.
No member yet
Proof before report
Each lead is tested in an isolated sandbox. Findings keep the steps, output and a status: confirmed, unclear or rejected.
No member yet
Draft reports per program
Turn a confirmed finding into a draft with title, impact, steps and affected files, shaped for the platform you pick.
No member yet
Self-hosted runner
Code and results stay on your machine. The web app only shows job status and notes you choose to sync.
No member yet
Brand identityAI proposal
Check the name against trademark registers before using it.
Palette
#0F3D3EDeep Teal · primary#F4F1EAPaper · surface#16201FInk · text#E0A100Signal Amber · accent#4C8C6BMoss · data: confirmed
Typography
Aa
Leadtrace
ABCDEFGHIJKLMNOPQRSTUVWXYZ 0123456789
Follow every lead. Report only what holds up.
PricingAI proposal
The material gives no competitor prices for this kind of tool. These tiers are a starting point to test, based on usage as the opportunity suggests.
Solo
$29 a month
- 1 runner
- Up to 10 scans a month
- Draft reports
- Bring your own model keys
Pro
$79 a month
- 3 runners
- Unlimited scans
- Scope guard and duplicate check
- Sandbox proof runs
- Spend caps per job
Team
$249 a month
- 10 runners
- Shared findings and notes
- Role-based access
What it could be worthEstimate
What a software business making this much sells for today, from real deals. Pick a monthly revenue.
If it makes
Worth about
$194,000
Sale range $132,000 to $263,000
$120,000 a year in revenue
From 87 software businesses listed and sold on Empire Flippers in the last year, revenue vetted by the broker: they sell for about 19× their monthly revenue, most between 13× and 26×.
Measured on profit, the middle deal is 32× monthly net profit: about 2.7 years of profit.
An estimate, not an offer or financial advice. A real price depends on profit, growth, churn, how much of the work is the owner's, and the buyer.
How it would growAI proposal
How the product would reach new customers through its own use, and how the first ones would be found. A plan to test, not a result.
- Built-in loop
- No loop in the product. Researchers use it privately. Drafts go to bounty platforms under the user's own name, not ours, so use does not spread the product by itself.
- Do they become customers?
- Reach comes from content, communities and demos. Test whether solo researchers pay after the first confirmed finding, and whether teams adopt shared use.
- First customers
- Solo smart-contract auditors and bounty hunters who file on Immunefi and HackenProof and already pay for their own tooling and model access.
- Where to reach them
- GitHub: Publish a free sample runner and example findings, aimed at people starring similar open-source projects.
- Security Discord and X: Share worked examples of confirmed findings and ask researchers to try the tool on their own targets.
- First milestone
- Ten paying researchers on Solo or Pro, with at least half of them confirming one finding that they report.
Why people already pay for this
- VerifiedGitHub repository gained 2237 stars in 82 days
- Public claimThe tool orchestrates AI agents to find and validate security issues in code, automating parts of the vulnerability research workflow
- Public claimThere is demand from security researchers across multiple bug bounty platforms (HackerOne, Immunefi, HackenProof), indicating a paying market for vulnerability discovery tools
- Public claimThe tool supports self-hosted deployment, suggesting demand from security-conscious organizations and researchers who need on-premises vulnerability research capabilities
Tech stack
Every proposal builds on the same PWA base, installable from the browser on any phone or computer. Dashed boxes are what this app adds.
- AppNext.js and TypeScript
- PWAManifest and service worker
- UITailwind CSS
- Data and authSupabase Postgres
- PaymentsStripe
- EmailResend
- HostingVercel
- This app · Self-hosted runnerContainerised worker agentCode is scanned on the user's machine, with results synced to the web app.
- This app · SandboxIsolated container executionFindings need to be reproduced safely without touching real targets.
RisksAI inference
- AIAgents may report false positives or miss real flaws. Sandbox proof reduces noise but cannot cover every bug class, so early trust depends on measured accuracy.
- RegulatoryAutomated testing must stay inside program scope and the law. Scope guard helps, but misuse by users is possible and terms must address it.
- PlatformBounty platforms may restrict AI-generated or low-quality submissions, which could limit how drafts can be used.
- CommercialOpen-source tools with similar aims are gaining attention and are free, so paid value must come from proof, reporting and convenience.
- TechnicalA safe, self-hosted sandbox that works on many machines and codebases is hard to build and support.
Everything marked AI proposal or AI inference was written by a model from the evidence on the opportunity page. The proposed name must be checked against trademark registers before it is used.