Quickstart

The fastest way to get value from TraceGuard is to connect a GitHub repository. No CI changes, no files to generate — you'll have prioritized findings in a few minutes.

1. Sign in and open your organization

After signing up you'll complete a short welcome step, then land in your organization — the tenant that owns your projects and data. (You may have one created for you or be invited to an existing one.)

2. Connect GitHub — once per organization

Go to Integrations and choose Connect GitHub. This installs the TraceGuard GitHub App on your GitHub account or org, where you pick exactly which repositories it can access. You only do this once per organization.

3. Import a repository — this creates the project

From Integrations → Import repositories (or Projects → New project), pick a repo and set:

• Name and, for monorepos, a Root directory (import the same repo once per service).
• Branch to track.
• SBOM source — how TraceGuard gets the Bill of Materials:
  • Dependency graph (GitHub) — reads GitHub's dependency graph. Zero setup.
  • Server-side Syft — TraceGuard runs Syft against the repo for you.
• Optionally turn on a scan schedule (daily / weekly / monthly).

Creating it makes the project and links the repo in one step (1 project ↔ 1 repo).

4. TraceGuard does the rest

On import — and on every push — TraceGuard fetches the SBOM, parses it, and scans the components for vulnerabilities (enriched with KEV and EPSS). Watch progress on the project's BOMs view, then open Vulnerabilities to see findings ranked by what actually matters. Try the live preview in Vulnerabilities & scanning.

Not on GitHub?

For built artifacts, container images, or non-GitHub CI, use the CI Action path — the highest-fidelity source:

1. Create a project with SBOM source CI Action (or Start blank).
2. Generate a deploy token (Project settings → Integrations → Deploy tokens).
3. Push SBOMs from CI with the GitHub Action or a curl upload.

See Getting SBOMs in for all the paths side by side.