trenchcoat
Free · no sign-up
Website report · 31 Oct 2026

tracerai.fun

“TRACER | Security Agent”

Template-written 77 evidence items Code reader analysed 65 scripts
What this means for you

TRACER talked to 3 outside services on a first visit.E8E6E7

  • Tech check: the site claims ai / agents, live data / analytics and a working app / platform, and its public page shows matching evidence.E74E75E24E27E31
  • We saw no known analytics or advertising services load on the first visit.E1
  • Its code still includes Google tag (gtag.js), Meta Pixel and Microsoft Clarity, which may switch on later (for example after you accept cookies or sign in).E14E15E16

Tech check

What the site says about itself, next to what its public page actually loads. Facts only, no verdict: you decide.

Evidence found

AI / agents

“…orthflank security breach leads to abuse of customers' AI API keys BleepingComputer · Published Oct 31, 2026, 6:…”E74

AI-looking endpoints: /agent, /api/agent/status, /api/agent/streamE24E27E31E32

Evidence found

Live data / analytics

“…t feed Reporting & known exploited vulnerabilities All signals Security reports Exploited vulnerabilities All sources…”E75

Calls to its own backend: /api/changelog, /api/lifetime-deals, /pricingE21E22E23E24

Evidence found

A working app / platform

“…hflank security breach leads to abuse of customers' AI API keys BleepingComputer · Published Oct 31, 2026, 6:01 P…”E76

Calls to its own backend: /api/changelog, /api/lifetime-deals, /pricingE21E22E23E24

Calls its own backend /api/changelog, /api/lifetime-deals, /pricingE21E22E23E24
Wallet code none seen
Contract calls in its code none seen
Talks to AI services none seen
Live connections none seen

What it is

  • The Internet Archive has never saved this site, so it is probably new.E77
  • The site describes itself as: “Create stunning 3D immersive websites in minutes on Solana, no coding required. Simply enter a prompt and launch your site instantly. Plans ”E2
  • It's built with React and Next.js (common tools for building web apps).E10E11
  • Notable building blocks in its code: Three.js (3D graphics) and Firebase SDK.E12E13
  • In your browser it stores data in your browser's built-in database and saves small bits of data in your browser.E18E19
  • It has sections such as /report-abuse and /bounties.E73
  • While loading, it called 8 endpoints on its own servers, such as /api/changelog, /api/lifetime-deals, /pricing and 5 more.E21E22E23E24

Where your data goes

CDNs & hostingDeliver files (scripts, images) quickly from servers near you. 1
cdnjs.cloudflare.comCloudflare: CDN and hosting 3×E8
Not identifiedServices we don't have in our list yet. 2
images.unsplash.comnot identified 5×E6
statics.startupbase.ionot identified 1×E7

How key features work

AI features

Parts of the site talk to AI services or AI endpoints (/api/chat/assistant/upload, /v2/accounts/mfaEnrollment:start, /v2/accounts/mfaEnrollment:finalize, /api/chat/assistant and 1 more). Text you type there may be sent to them.E38E62E65E70

/api/chat/assistant/upload/v2/accounts/mfaEnrollment:start/v2/accounts/mfaEnrollment:finalize/api/chat/assistant/api/chat/assistant/escalate

Sign-in and accounts

Sign-in and account features show up in its code or traffic (/api/user/sync-complimentary-basic, /api/user/activity-ping, /api/user/utm-attribution and /api/auth/send-verification-email).E34E35E36

/api/user/sync-complimentary-basic/api/user/activity-ping/api/user/utm-attribution/api/auth/send-verification-email

Loading its content

Its content loads from its own API while you browse (/api/changelog, /api/lifetime-deals, /pricing, /agent and 2 more).E21E22E23E24E25

/api/changelog/api/lifetime-deals/pricing/agent/api/projects/api/monitor

Drawing and editing in the browser

The page draws and edits graphics in your browser using Three.js (3D graphics) and the canvas.E12E20

Three.js (3D graphics)canvas

Measuring what you do

Visits and clicks are measured with Google tag (gtag.js), Meta Pixel and Microsoft Clarity (found in its traffic or its code).E14E15E16

Google tag (gtag.js)Meta PixelMicrosoft Clarity

Saving data on your device

It saves data in your browser (IndexedDB (a browser database) and localStorage), so some things persist between visits.E18E19E9

indexeddblocal_storageIndexedDB

Cookies and storage

Names only. We never store the values.

IndexedDBE9: firebase-heartbeat-database, firebaseLocalStorageDb

Pages and API calls

Pages it links to

//report-abuse/bounties

Endpoints

Called while loading (seen) or named in the code (code).

tracerai.fun/api/changelogseenE21
tracerai.fun/api/lifetime-dealsseenE22
tracerai.fun/pricingseenE23
tracerai.fun/agentseenE24
tracerai.fun/api/projectsseenE25
tracerai.fun/api/monitorseenE26
tracerai.fun/api/agent/statusseenE27
tracerai.fun/legal/cookiesseenE28
/api/changelogcodeE29
/api/lifetime-dealscodeE30
/api/agent/statuscodeE31
/api/agent/streamcodeE32
/api/checkcodeE33
/api/user/sync-complimentary-basiccodeE34
/api/user/activity-pingcodeE35
/api/user/utm-attributioncodeE36
/api/auth/send-verification-emailcodeE37
/api/chat/assistant/uploadcodeE38
/api/affiliate/set-cookiecodeE39
/api/affiliate/clickcodeE40
/api/affiliate/convertcodeE41
/api/user/accept-termscodeE42
/api/user/apply-referralcodeE43
/api/auth/local-google/statuscodeE44
/api/auth/embedded-bridge/createcodeE45
/api/projectscodeE46
/api/monitorcodeE47
/api/check/streamcodeE48
/v2/recaptchaConfigcodeE49
/v1/accounts:deletecodeE50

Evidence

Every sentence above points to one of these. Code references show the file, line:column and the short identifier that matched, never the site's code itself.

E1
Page title: TRACER | Security Agent
page title · https://tracerai.fun/
E2
Page description: Create stunning 3D immersive websites in minutes on Solana, no coding required. Simply enter a prompt and launch your site instantly. Plans from $25/m
page description · https://tracerai.fun/
E3
Site name: TRACER
page site_name · https://tracerai.fun/
E4
Main heading: TRACER — Solana Threat Monitoring and Dependency Exposure Audits
page h1 · https://tracerai.fun/
E5
115 request(s) to tracerai.fun
types: 58 image, 32 script, 9 font
GET https://tracerai.fun/ · image · 115 requests · network recording
E6
5 request(s) to images.unsplash.com
types: 5 image
GET https://images.unsplash.com/photo-1524504388940-b1c1722653e1 · image · 5 requests · network recording
E7
1 request(s) to statics.startupbase.io
types: 1 image
GET https://statics.startupbase.io/site/badges/featured-on-sb-neutral.svg · image · network recording
E8
3 request(s) to cdnjs.cloudflare.com
types: 2 font, 1 stylesheet
GET https://cdnjs.cloudflare.com/ajax/libs/font-awesome/6.5.1/css/all.min.css · font · 3 requests · network recording
E9
IndexedDB: 2 key(s) saved in your browser
IndexedDB keys: firebase-heartbeat-database, firebaseLocalStorageDb · values not stored
E10
React detected by the code reader (react-runtime)
confidence: medium
tracerai.fun/_next/static/chunks/fd9d1056-1f975ac3c56a4bd3.js · “react-runtime” · the code reader
E11
Next.js detected by the code reader (next-runtime)
confidence: high
tracerai.fun/_next/static/chunks/4141-13c90c332442a0ad.js · “next-runtime” · the code reader
E12
Three.js (3D graphics) found in the code
tracerai.fun/globe/earth.js @ 1:27 · “three.module” · pattern scan
E13
Firebase SDK found in the code
tracerai.fun/ (page HTML) @ 1:277794 · “FIREBASE_” · pattern scan
E14
Google tag (gtag.js) found in the code
tracerai.fun/_next/static/chunks/4456-703feb18b10c15ce.js @ 1:26259 · “googletagmanager.com/gtag” · pattern scan
E15
Meta Pixel found in the code
tracerai.fun/_next/static/chunks/app/layout-ec961ce3c41d7875.js @ 1:2809 · “connect.facebook.net/en_US/fbevents” · pattern scan
E16
Microsoft Clarity found in the code
tracerai.fun/_next/static/chunks/app/layout-ec961ce3c41d7875.js @ 1:3306 · “clarity.ms” · pattern scan
E17
reCAPTCHA found in the code
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:37049 · “grecaptcha” · pattern scan
E18
Uses the browser ability: indexeddb
stores data in your browser's built-in database
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:55936 · “indexedDB.open(” · pattern scan
E19
Uses the browser ability: local_storage
saves small bits of data in your browser
tracerai.fun/_next/static/chunks/1457-b35bd8d99d4c3a6c.js @ 1:1701 · “localStorage.setItem(” · pattern scan
E20
Uses the browser ability: canvas
draws graphics on a canvas
tracerai.fun/globe/earth.js @ 16:189 · “getContext('2d'” · pattern scan
E21
The page called /api/changelog on tracerai.fun (GET)
GET https://tracerai.fun/api/changelog · fetch · network recording
E22
The page called /api/lifetime-deals on tracerai.fun (GET)
GET https://tracerai.fun/api/lifetime-deals · fetch · network recording
E23
The page called /pricing on tracerai.fun (GET)
GET https://tracerai.fun/pricing · fetch · network recording
E24
The page called /agent on tracerai.fun (GET)
GET https://tracerai.fun/agent · fetch · network recording
E25
The page called /api/projects on tracerai.fun (GET)
GET https://tracerai.fun/api/projects · fetch · network recording
E26
The page called /api/monitor on tracerai.fun (GET)
GET https://tracerai.fun/api/monitor · fetch · network recording
E27
The page called /api/agent/status on tracerai.fun (GET)
GET https://tracerai.fun/api/agent/status · fetch · network recording
E28
The page called /legal/cookies on tracerai.fun (GET)
GET https://tracerai.fun/legal/cookies · fetch · network recording
E29
Code reader found the endpoint /api/changelog
how: call:fetch
tracerai.fun/_next/static/chunks/459-bf4f9adf02ad870e.js @ 1:5329 · “/api/changelog” · the code reader
E30
Code reader found the endpoint /api/lifetime-deals
how: call:fetch
tracerai.fun/_next/static/chunks/app/%5Blocale%5D/layout-e27b08b7f44955f5.js @ 1:3713 · “/api/lifetime-deals” · the code reader
E31
Code reader found the endpoint /api/agent/status
how: call:fetch
tracerai.fun/cascade-companion.js @ 20:1 · “/api/agent/status” · the code reader
E32
Code reader found the endpoint /api/agent/stream
how: call:fetch
tracerai.fun/cascade-companion.js @ 32:17 · “/api/agent/stream” · the code reader
E33
Code reader found the endpoint /api/check
how: call:fetch
tracerai.fun/cascade-companion.js @ 76:226 · “/api/check” · the code reader
E34
Code reader found the endpoint /api/user/sync-complimentary-basic
how: call:fetch
tracerai.fun/_next/static/chunks/3563-0331bef393107796.js @ 1:1939 · “/api/user/sync-complimentary-basic” · the code reader
E35
Code reader found the endpoint /api/user/activity-ping
how: call:fetch
tracerai.fun/_next/static/chunks/app/layout-ec961ce3c41d7875.js @ 1:10034 · “/api/user/activity-ping” · the code reader
E36
Code reader found the endpoint /api/user/utm-attribution
how: call:fetch
tracerai.fun/_next/static/chunks/app/layout-ec961ce3c41d7875.js @ 1:10438 · “/api/user/utm-attribution” · the code reader
E37
Code reader found the endpoint /api/auth/send-verification-email
how: call:fetch
tracerai.fun/_next/static/chunks/app/layout-ec961ce3c41d7875.js @ 1:11407 · “/api/auth/send-verification-email” · the code reader
E38
Code reader found the endpoint /api/chat/assistant/upload
how: call:fetch
tracerai.fun/_next/static/chunks/app/layout-ec961ce3c41d7875.js @ 1:24829 · “/api/chat/assistant/upload” · the code reader
E39
Code reader found the endpoint /api/affiliate/set-cookie
how: call:fetch
tracerai.fun/_next/static/chunks/1457-b35bd8d99d4c3a6c.js @ 1:995 · “/api/affiliate/set-cookie” · the code reader
E40
Code reader found the endpoint /api/affiliate/click
how: call:fetch
tracerai.fun/_next/static/chunks/1457-b35bd8d99d4c3a6c.js @ 1:2366 · “/api/affiliate/click” · the code reader
E41
Code reader found the endpoint /api/affiliate/convert
how: call:fetch
tracerai.fun/_next/static/chunks/1457-b35bd8d99d4c3a6c.js @ 1:2609 · “/api/affiliate/convert” · the code reader
E42
Code reader found the endpoint /api/user/accept-terms
how: call:fetch
tracerai.fun/_next/static/chunks/1457-b35bd8d99d4c3a6c.js @ 1:3685 · “/api/user/accept-terms” · the code reader
E43
Code reader found the endpoint /api/user/apply-referral
how: call:fetch
tracerai.fun/_next/static/chunks/1457-b35bd8d99d4c3a6c.js @ 1:4303 · “/api/user/apply-referral” · the code reader
E44
Code reader found the endpoint /api/auth/local-google/status
how: call:fetch
tracerai.fun/_next/static/chunks/1457-b35bd8d99d4c3a6c.js @ 1:4573 · “/api/auth/local-google/status” · the code reader
E45
Code reader found the endpoint /api/auth/embedded-bridge/create
how: call:fetch
tracerai.fun/_next/static/chunks/1457-b35bd8d99d4c3a6c.js @ 1:4762 · “/api/auth/embedded-bridge/create” · the code reader
E46
Code reader found the endpoint /api/projects
how: call:fetch
tracerai.fun/cascade-live.js @ 105:1 · “/api/projects” · the code reader
E47
Code reader found the endpoint /api/monitor
how: call:fetch
tracerai.fun/cascade-live.js @ 112:20 · “/api/monitor” · the code reader
E48
Code reader found the endpoint /api/check/stream
how: call:fetch
tracerai.fun/cascade-live.js @ 133:19 · “/api/check/stream” · the code reader
E49
The code names the endpoint /v2/recaptchaConfig
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:8674 · “/v2/recaptchaConfig” · pattern scan
E50
The code names the endpoint /v1/accounts:delete
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:8744 · “/v1/accounts:delete” · pattern scan
E51
The code names the endpoint /v1/accounts:lookup
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:8809 · “/v1/accounts:lookup” · pattern scan
E52
The code names the endpoint /v1/token
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:12447 · “/v1/token” · pattern scan
E53
The code names the endpoint /v2/accounts:revokeToken
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:12741 · “/v2/accounts:revokeToken” · pattern scan
E54
The code names the endpoint /v2/passwordPolicy
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:23439 · “/v2/passwordPolicy” · pattern scan
E55
The code names the endpoint /v1/accounts:signUp
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:38803 · “/v1/accounts:signUp” · pattern scan
E56
The code names the endpoint /v1/accounts:signInWithPassword
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:38869 · “/v1/accounts:signInWithPassword” · pattern scan
E57
The code names the endpoint /v1/accounts:signInWithEmailLink
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:38952 · “/v1/accounts:signInWithEmailLink” · pattern scan
E58
The code names the endpoint /v1/accounts:signInWithIdp
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:40479 · “/v1/accounts:signInWithIdp” · pattern scan
E59
The code names the endpoint /v1/accounts:sendVerificationCode
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:42140 · “/v1/accounts:sendVerificationCode” · pattern scan
E60
The code names the endpoint /v1/accounts:signInWithPhoneNumber
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:42225 · “/v1/accounts:signInWithPhoneNumber” · pattern scan
E61
The code names the endpoint /v1/accounts:signInWithCustomToken
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:49937 · “/v1/accounts:signInWithCustomToken” · pattern scan
E62
The code names the endpoint /v2/accounts/mfaEnrollment:start
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:60182 · “/v2/accounts/mfaEnrollment:start” · pattern scan
E63
The code names the endpoint /v2/accounts/mfaSignIn:start
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:60529 · “/v2/accounts/mfaSignIn:start” · pattern scan
E64
The code names the endpoint /v1/projects
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:68825 · “/v1/projects” · pattern scan
E65
The code names the endpoint /v2/accounts/mfaEnrollment:finalize
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:75249 · “/v2/accounts/mfaEnrollment:finalize” · pattern scan
E66
The code names the endpoint /v2/accounts/mfaSignIn:finalize
tracerai.fun/_next/static/chunks/69806262-c3b5c6abd867dce2.js @ 1:75423 · “/v2/accounts/mfaSignIn:finalize” · pattern scan
E67
The code names the endpoint /api/auth/local-google
tracerai.fun/_next/static/chunks/1457-b35bd8d99d4c3a6c.js @ 1:6973 · “/api/auth/local-google” · pattern scan
E68
The code names the endpoint /api/dodo/verify
tracerai.fun/_next/static/chunks/3563-0331bef393107796.js @ 1:2283 · “/api/dodo/verify” · pattern scan
E69
The code names the endpoint /api
tracerai.fun/_next/static/chunks/459-bf4f9adf02ad870e.js @ 1:397 · “/api” · pattern scan
E70
The code names the endpoint /api/chat/assistant
tracerai.fun/_next/static/chunks/app/layout-ec961ce3c41d7875.js @ 1:23176 · “/api/chat/assistant” · pattern scan
E71
The code names the endpoint /api/chat/assistant/escalate
tracerai.fun/_next/static/chunks/app/layout-ec961ce3c41d7875.js @ 1:25792 · “/api/chat/assistant/escalate” · pattern scan
E72
The code names the endpoint /api/chat/assistant/email-transcript
tracerai.fun/_next/static/chunks/app/layout-ec961ce3c41d7875.js @ 1:26355 · “/api/chat/assistant/email-transcript” · pattern scan
E73
3 links to pages on the same site
page links · https://tracerai.fun/ · /, /report-abuse, /bounties
E74
The site says: “…orthflank security breach leads to abuse of customers' AI API keys BleepingComputer · Published Oct 31, 2026, 6:…”
page text · https://tracerai.fun/ · …orthflank security breach leads to abuse of customers' AI API keys BleepingComputer · Published Oct 31, 2026, 6:…
E75
The site says: “…t feed Reporting & known exploited vulnerabilities All signals Security reports Exploited vulnerabilities All sources…”
page text · https://tracerai.fun/ · …t feed Reporting & known exploited vulnerabilities All signals Security reports Exploited vulnerabilities All sources…
E76
The site says: “…hflank security breach leads to abuse of customers' AI API keys BleepingComputer · Published Oct 31, 2026, 6:01 P…”
page text · https://tracerai.fun/ · …hflank security breach leads to abuse of customers' AI API keys BleepingComputer · Published Oct 31, 2026, 6:01 P…
E77
The Internet Archive has no saved copy of tracerai.fun
page web archive · https://web.archive.org/web/*/tracerai.fun

Limits

  • We only see what your browser sees: code and requests on a first visit, without logging in or accepting cookie banners. What the servers do with data is invisible from outside.
  • Site code is usually minified (compressed), so names are partly lost and some code may be only partly analysed.
  • Some trackers only load after you accept cookies or log in, so the real list can be longer.
  • We visited from a server in the United States. Sites load different trackers and cookie banners in different countries (visitors in the EU usually get a consent banner first).
  • The tech check compares the site's own words with what its public page loads. Work done on servers, in private code or in separate apps isn't visible here, so 'nothing found' means not visible on the public page, not that it doesn't exist.
  • This text was written from fixed templates because no AI writer was available. It uses exactly the same evidence.
  • The code reader hit its size budget on parts of 45 large bundle file(s); those parts weren't fully analysed.

Facts, not judgements: this page describes what the code and traffic show, not anyone's intent. Not financial advice. Case id MifDQMgd.