Stop copy-pasting curl commands between Notepad and a terminal window. Trapline runs them, flags juicy output in real time, and generates the full HackerOne report when you're done — CVSS vector, OWASP ref, impact statement.
/// No account. No subscription. One price. ///
No config files. No API keys. Open the app, pick your target, start hunting.
Browse 215 commands across 30 categories or search by keyword. Start with Quickfire for the highest-ROI tests on any new target.
Hit run. Output streams live. Every line scans against 94 detection rules as it arrives — no waiting for the command to finish.
ATO tokens, secrets, private IPs, CORS misconfigs — color-coded by severity and flagged in real time before you finish reading.
Click the bug icon, fill in the program name, hit Generate. Complete HackerOne-ready report with CVSS vector, OWASP reference, and impact statement.
Five of the eleven Quickfire tests — the config.json sweep alone has surfaced findings on three separate programs.
Every command was added because it found something on a live program. No CTF fluff — just the workflows that actually pay.
Every command came from a real engagement. Quickfire fires the highest-ROI tests first — config.json sweep, CORS origin reflection, Kong portal UUID leak, idToken field scan. One of those four has paid out on every program I've tested seriously. 30 categories, live search.
94 patterns scan every output line as it prints — not generic keyword matching. ATO token fields (idToken, access_token, oauth_token), Stripe/Twilio/SendGrid keys, private IPs, MongoDB connection strings, AWS ARNs. The output most hunters scroll past gets lit up in red before you've finished reading.
Every hunter has lost a finding to a closed browser tab. Click the bug icon on any output card — title, severity, program, endpoint, PoC curl, impact, remediation. Everything persists to a local JSON file between sessions. No cloud sync, no account, no third party touching your draft reports.
Hit Generate Report on any tracked finding. You get the exact HackerOne template: CVSS:3.1 vector + score auto-calculated, OWASP reference matched from title keywords, impact statement with the business-risk formula triagers actually reward. Copy and paste. Thirty minutes down to ten seconds.
Capture the output, fill a few fields, hit generate. The hard part is done for you.
New surface is unhardened surface — whoever sees the change first gets the bug. Watch runs your recon on a schedule and watches a target’s JavaScript. When a bundle changes, it rebuilds the original source from exposed source maps and diffs it per source-file, so bundle-hash churn is zero noise. Free runs when you do. Pro runs while you sleep.
It’s 3am. Somewhere, a deploy ships a new /admin route and a forgotten API key into a rebuilt JS bundle. By the time you run recon at noon, three other hunters already diffed it — and one already filed. Watch is the one that pinged at 3:02am.
An always-on sensor pointed at the part of the app that keeps moving.
@@ 1 file changed · 1 chunk @@ - a={t:e=>n.p(e,"v2"),f:!0,r:[...4831]} - O=(s,c)=>fetch(c+"/u",{h:s}).then(d=>d.j()) + a={t:e=>n.p(e,"v2"),f:!0,r:[...4877]} + O=(s,c)=>fetch(c+"/u",{h:s}).then(d=>d.j()) + w=(i)=>fetch("/i/v3/p/"+i+"/x",P) // 12,904 tokens of churn. // hash differs. signal: none.
// rebuilt from /bundle.4f9c2a.js.map flags: { invoicesV2: true }, getUser = (h) => fetch(API + "/u", { h }), + NEW endpoint payoutFor = (id) => fetch(`/internal/v3/payouts/${id}/release`, P) // real file names. real route. // /internal/v3/* — shipped 4m ago.
Same change, both panels. Left is what a hash compare gives you. Right is what Watch actually does — it reconstructs the source and diffs the set of routes, endpoints, secrets and flags per source-file, so churn is silent and real surface is loud.
One command installs a Windows Scheduled Task. Watch reruns your recon on its own — on your box, no cloud, no account, nothing leaves your machine. Per-target in-scope host gating and a global rate limit keep it from ever wandering off target or hammering a program.
Every run it pulls the target’s JavaScript and compares it to last time. Bundle hash churned but nothing real moved? Zero noise. It only fires when the underlying source actually changes.
When a bundle changes, Watch rebuilds the original source files from exposed source maps — real file names, readable code — and diffs them per source-file. New endpoints, routes, secrets, and feature flags surface the moment they ship.
It pings your Discord the instant something new appears — then writes a native draft finding straight into Trapline, ready for the one-click HackerOne report generator. Zero-click from new surface to drafted report.
● NEW SURFACE acme.com · 02:14 local + endpoint POST /internal/v3/payouts/{id}/release + source src/api/billing.ts (reconstructed) + flag invoicesV2: true draft finding written to Trapline → ready to report
Watch is a separate single binary, included with Trapline Pro. JS + source-map diffing is the working hero today — more surface coming.
Built by a working hunter — findings on LPL Financial, Priceline, Dyson & Inspectorio. Watch ships inside Trapline Pro — $9 one-time ↓
Free is the full manual tool on Windows. Pro is $9 one-time and adds Trapline Watch — the always-on sensor that reconstructs a target’s changed JS from its source maps and pings you the moment new surface ships — plus every platform and every future update. For less than a coffee.
One-time payment. No subscription. No account required.