Trace Arena
CTF training, ranking & certification for researchers
The supply-side engine of the entire BugsTrace platform. Trace Arena trains researchers, verifies their skills, and feeds the bug bounty platform with a continuous pipeline of qualified hunters — while standing alone as a subscription and licensable education product.
In active development
Trace Arena is being built right now. Launching 2026. Join the waitlist for early access and launch updates.
Training that actually maps to earning.
HackTheBox and TryHackMe teach skills against arbitrary challenge themes that drift from the real-world attack surface. Researchers grind challenges that don't translate into program-ready ability.
Trace Arena's edge is threefold: challenge content reflects current production technology stacks, learning paths are structured around the exact skill categories used in live programs, and performance directly translates to real earning opportunity on TraceX.
Built to produce program-ready hunters.
Every track maps to a skill category used by the TraceX matching system, so progress in the Arena directly changes which programs a researcher is matched to.
Real-stack challenge library
Challenges are built around real technology — React, Node.js, AWS, GraphQL, Kubernetes, Android, iOS — and categorised by vulnerability class like XSS, SQLi, IDOR, and SSRF.
Structured skill tracks
Researchers follow defined learning tracks instead of free browsing. Each track maps to a real-world vulnerability category and earns a verified skill tag on completion.
On-chain certification
Completed tracks produce a BugsTrace Certification with blockchain attestation, so credentials cannot be faked or inflated and are verifiable by employers.
Rolling content refresh
Challenges retire and are replaced on a 6-month cycle to track the real attack surface, curated by an editorial board of active platform researchers.
Direct path to earning
Top performers are fast-tracked into the BugsTrace researcher pool at Intermediate tier, bypassing the standard assessment process.
University partnerships
Co-branded, accredited cybersecurity courses where the university provides credentialing and BugsTrace provides the platform, challenges, and certification.
Skill tracks.
Each track maps to a live program category and earns a verifiable certification.
| Track | Skill categories covered | Difficulty | Est. completion |
|---|---|---|---|
| Web Foundations | XSS, SQLi, CSRF, auth bypass, sessions | Beginner → Intermediate | 20–30 hrs |
| API Security | REST, GraphQL, auth, rate limiting, BOLA/BFLA | Intermediate → Advanced | 25–35 hrs |
| Mobile Security | Android, iOS, APK analysis, deep link abuse | Intermediate → Advanced | 30–40 hrs |
| Cloud & Infrastructure | AWS, GCP, Azure, K8s, container escape | Advanced → Elite | 40–60 hrs |
| Business Logic | Logic flaws, price manipulation, workflow bypass | Intermediate → Elite | 20–30 hrs |
| Binary & Reverse Eng. | Buffer overflow, format strings, reversing | Advanced → Elite | 50–80 hrs |
Train on what's real. Get matched to what you can win.
Trace Arena turns practice into a verifiable profile that opens private program invitations on TraceX — and gives universities and security teams a licensable training platform.
