Trapline — The Bug Bounty Recon Deck

How it works

Four steps from recon to report

No config files. No API keys to get started. Open the app, pick a target, start hunting.

01

Pick a command

Browse 215 commands across 30 categories or search by keyword. Start with Quickfire for the highest-ROI tests on any new target.

02

Run it

Hit run. Output streams live, and every line scans against 94 detection rules as it arrives — no waiting for the command to finish.

03

Flags fire

ATO tokens, secrets, private IPs, CORS misconfigs — color-coded by severity and flagged in real time before you finish reading.

04

Generate the report

One click: a complete HackerOne-ready report with CVSS vector, OWASP reference, and a business-impact statement.

Features

Built from real findings, not tutorials

Every command was added because it found something on a live program. No CTF fluff — just the workflows that pay.

215 Battle-Tested Commands

Every command came from a real engagement. Quickfire fires the highest-ROI tests first — config.json sweep, CORS reflection, Kong portal UUID leak, idToken scan. 30 categories, live search.

QuickfireIDORCORSGraphQLSSRFAI/LLM+24 more

Real-Time Flag Detection

94 patterns scan every output line as it prints. ATO token fields (idToken, access_token), Stripe/Twilio keys, private IPs, Mongo strings, AWS ARNs — lit up in red before you finish reading.

ATO tokensAPI secretsPrivate IPsAWS keysCORS

NEW

Breach Intelligence

Check any email, username, or domain against five breach databases from one bar — LeakCheck, Snusbase, DeHashed, LeakRadar & Shodan — and read every result in one formal table.

LeakCheckSnusbaseDeHashedLeakRadarShodan

BUILT IN

Trapline Watch

The always-on sensor, built right in. It runs recon on a schedule, reconstructs a target's changed JS from its source maps, pings Discord, and auto-drafts the finding into Trapline.

ScheduledSource-map diffDiscord pingAuto-draft

Never Lose a Finding

Click the bug icon on any output card — title, severity, program, endpoint, PoC, impact. Everything persists to a local JSON file between sessions. No cloud, no account, no third party.

Local JSONSession persistCVSS scoring

NEW

One-Click Reports & Export

Generate the exact HackerOne template — CVSS + OWASP auto-filled. Export any breach search to MD, HTML, CSV, JSON or TXT, or drop it straight into a bug-bounty report.

HackerOneMDHTMLCSVJSON

Breach Intelligence

Five databases. One table.

Information disclosure is step one. Check an email, username, or domain against five providers at once — then read every leaked field in a single formal table, revealed by default so nothing hides.

One bar, five sources
LeakCheck, Snusbase, DeHashed, LeakRadar & Shodan — normalized into a single result set.
Nothing blurred
Emails, usernames, plaintext passwords, hashes, phones & IPs — shown in cleartext for authorized work.
Export for the client
One click to MD / HTML / CSV / JSON / TXT, organized by source — or straight into a bug-bounty report.

breach · acme.com SnusbaseDeHashed

⚠️ Authorized use only — third-party breach credentials, shown in cleartext.

Email	Username	Password	Source
neo@acme.com	neo	hunter2	Collection#1
trin@acme.com	trinity	m0rpheus!	BreachCo '19
tank@acme.com	tank	z10nRocks	DeHashed

Export MDHTMLCSVJSONTXT + Bug-bounty report

found by the plug @foodstampplug

# watch-alerts just now · 02:14 local

● NEW SURFACE acme.com + endpoint POST /internal/v3/payouts/{id}/release + source src/api/billing.ts (reconstructed) + flag invoicesV2: true draft finding written to Trapline → ready to report

JS + source-map diffDiscord pingnative draft

Trapline Watch · built in

The diff is the alpha.

New surface is unhardened surface — whoever sees the change first gets the bug. Watch runs your recon on a schedule and watches a target's JavaScript. When a bundle changes, it rebuilds the original source from exposed source maps and diffs it per file, so bundle-hash churn is zero noise.

Runs while you sleep
A scheduled sensor on your own box — no cloud, no account. Scope-gated and rate-limited by default.
Reads real source
Reconstructs real file names and readable code from source maps — not minified soup — and diffs per file.
Ping → draft
New endpoints, secrets & flags ping your Discord, then land as a native draft finding, ready for the report generator.

Download

Everything. Free.

The whole deck — all 215 commands, real-time detection, breach intel, Watch, the finding tracker and the one-click report generator. No license key, no account, no upsell.

100% free · no account

Free

Windows .exe · direct download

All 215 commands across 30 categories
94 real-time detection rules
Breach intel — 5 databases in one table
Trapline Watch — source-map JS diffing
Finding tracker & one-click HackerOne reports
Export to MD / HTML / CSV / JSON / TXT
100% local — nothing leaves your box

Download Free · Windows

Free forever. No subscription, no license. macOS & Linux builds coming in v1.1 — free too.

FAQ

Common questions

No catch. Every feature — all 215 commands, real-time detection, breach intel across five databases, Trapline Watch, the finding tracker and the report generator — is free, with no license key and no account. If you want to support it, star the repo or join the Discord. That's the whole ask.

Yes. Trapline runs standard recon tools (subfinder, httpx, curl) that every bug bounty hunter uses. It doesn't exploit anything — it organizes your workflow and flags interesting output. You're responsible for only targeting in-scope programs, same as any other tool. Breach lookups require your own API keys and are for authorized engagements.

The app has a built-in tool checker that shows exactly what's installed and what's missing, with the install command for each. Curl ships with Windows. Everything else — subfinder, httpx, nuclei, ffuf — installs with one Go command.

No. Findings, reports, and session data live in a local JSON file on your machine. Nothing is sent to any Trapline server — there isn't one. The only outbound connections are the recon commands and breach lookups you choose to run against your targets. Plaintext passwords stay in memory and in the exports you generate; they're never written into the saved findings store.

Watch is the always-on sensor built right into Trapline — it runs your recon on a schedule and watches a target's JavaScript. When a bundle changes, it reconstructs the original source files from exposed source maps (real names, readable code — not minified soup) and diffs them per file, so routine bundle-hash churn is zero noise. The moment a new endpoint, route, secret, or flag appears, Watch pings your Discord and writes a native draft finding into Trapline. It runs entirely on your machine, scope-gated and rate-limited. The diff is the alpha — whoever sees new surface first gets the bug.

Trapline is Windows-only today (a single .exe). macOS and Linux builds are planned for v1.1 — and they'll be free, like everything else. No paid tier, no waiting list.

"

I've submitted findings on LPL Financial, Priceline, Dyson, Inspectorio, and a handful of others. The grind is always the same — you find something real, then spend the next 45 minutes formatting the same report for the fifth time that week. I stopped building Trapline as a tool and started building it as the workflow I actually follow on every engagement. If you've ever closed a browser tab and lost a finding, you already know why this exists.

@foodstampplug · GitHub · Discord