Identify All User-Controlled Entry PointsPublic

I’ll map the code paths where external input first enters the system (HTTP routes, query/path/body params, headers, and any CLI/env inputs), then trace where each one is consumed. I’m starting by scanning the repository structure and route/controller layers.

I found this repo is a recon workspace (artifacts and extracted client/CLI intel), not the target’s source code. Next I’m pulling the endpoint and parameter inventories from those artifacts to enumerate every user-input surface we can currently prove.

I hit noisy output in chunk_endpoints.txt (it includes entire bundled lines). I’m switching to targeted parsing of the curated recon files (guess_endpoints, chunk_urls, CLI endpoint extraction) so we can produce a reliable entry-point list.

I’ve isolated the useful CLI evidence: the extracted file is noisy, but it does contain concrete /v1/... request templates and auth flow URLs. I’m now extracting only those lines so the entry-point list is clean and complete.

I’m now consolidating all externally reachable surfaces from the recon artifacts (web routes + actions API + CLI-auth paths), and separating confirmed routes from guessed-but-unverified ones. I’ll also call out exactly which parts of each request are user-controlled (path IDs, query keys, body fields, headers).

I have enough evidence to enumerate the input surfaces now. I’m pulling exact line references from the artifact files so the list is auditable and you can trace each entry point back to source evidence quickly.

I have enough evidence to enumerate the input surfaces now. I’m pulling exact line references from the artifact files so the list is auditable and you can trace each entry point back to source evidence quickly.

All currently identifiable user-controlled entry points (from this recon workspace) are:

Web routes

• GET https://www.traces.com/s/{id} where {id} is user-controlled trace ID (evidence: /Users/hankyone/Traces-Pentest/artifacts/http/trace_page.html:1).
• GET https://www.traces.com/s/{id}/opengraph-image?... where {id} and query token are user-controlled URL components (evidence: /Users/hankyone/Traces-Pentest/artifacts/http/trace_page.html:1).
• GET https://www.traces.com/login (evidence: /Users/hankyone/Traces-Pentest/artifacts/http/path_literals.txt:18).
• GET https://www.traces.com/{namespaceSlug} (seen as user profile pages like /tarunsachdeva, /maxgeor; slug is user-controlled path input) (evidence: /Users/hankyone/Traces-Pentest/artifacts/http/index.html:17).
• GET https://www.traces.com/install (installer route) (evidence: /Users/hankyone/Traces-Pentest/notes/recon-summary-2026-02-11.md:24 and /Users/hankyone/Traces-Pentest/artifacts/http/url_literals.txt:19).

Actions API (actions.traces.com)

• GET /v1/feed (public) with user-controlled headers and possibly query params (evidence: /Users/hankyone/Traces-Pentest/artifacts/http/cors_probe.txt:1).
• /v1/session (CLI hits this; user controls auth/session headers/cookies, and method by client path) (evidence: /Users/hankyone/Traces-Pentest/artifacts/http/cors_probe.txt:12, /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/strings_traces_only.txt:181, /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/strings_traces_only.txt:185).
• /v1/traces and /v1/traces{query} where query string is user-controlled (evidence: /Users/hankyone/Traces-Pentest/artifacts/http/cors_probe.txt:23, /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:302).
• PUT /v1/traces/{externalId} where {externalId} is user-controlled (evidence: /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:301).
• DELETE /v1/traces/{externalId} where {externalId} is user-controlled (evidence: /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:305).
• POST /v1/traces/{traceExternalId}/messages/batch where {traceExternalId} and body are user-controlled (evidence: /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:303).
• PUT /v1/traces/{traceExternalId}/messages/{messageExternalId} where both IDs and body are user-controlled (evidence: /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:304).
• GET /v1/auth/github and callback /v1/auth/github/callback with user-controlled OAuth callback params (code, state) (evidence: /Users/hankyone/Traces-Pentest/artifacts/http/guess_endpoints.txt:30 and /Users/hankyone/Traces-Pentest/artifacts/http/guess_endpoints.txt:36).
• CLI auth endpoints:
  • /v1/auth/cli/start
  • /v1/auth/cli/status?state=... (state user-controlled query value)
  • /v1/auth/cli/complete (likely user-controlled body)
    (evidence: /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:308, /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:315, /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:316).

CLI input surfaces that drive remote calls

• User CLI args: share --trace-id, --source-path, --cwd, --agent, --follow, --json, plus login --no-browser (evidence: /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/help.txt:21).
• User-controlled env vars: TRACES_URL, TRACES_HTTP_URL, TRACES_API_URL (evidence: /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:293, /Users/hankyone/Traces-Pentest/artifacts/cli/v0.2.0/endpoints_cli.txt:298).

Not counted as active entry points: /v1/share, /v1/trace, /v1/auth/session (all returned 404 during probing) (/Users/hankyone/Traces-Pentest/artifacts/http/guess_endpoints.txt:12).