Recon Vault: Pentest Payloads & Recon Snippet Manager

Store & insert XSS/SQLi/SSRF payloads, recon commands & pentest report templates into any field in one click.

Stop context-switching between notes apps, Gists, and browser tabs during penetration tests and bug bounty engagements. Recon Vault keeps your most-used XSS, SQLi, and SSRF payloads, recon one-liners, and vulnerability report templates one click away — right inside the page you're testing. WHO IT'S FOR Bug bounty hunters, penetration testers, red teamers, and application security engineers who are tired of re-typing the same payloads and recon commands during every assessment. FEATURES Instant One-Click Insert: Inject payloads directly into active form fields, target inputs, or report submission forms on any website. Dynamic Variable Placeholders: Use tags like {{TARGET}} or {{ENDPOINT}} in your payloads. Recon Vault generates a quick fill-in prompt on insertion, saving manual formatting time. 46 Built-In Starter Snippets: Comes ready on install with real-world security testing payloads, reconnaissance commands, and vulnerability report templates covering the categories bug bounty hunters use most often. Keyboard-First Workflow: Press Cmd+Shift+K (Mac) or Ctrl+Shift+K (Windows) to instantly trigger the extension popup. Folder Filtering & Search: Rapidly search titles and snippet bodies or filter by category with a single click. Import & Export: Back up your entire snippet library to a JSON file, or restore/share it across machines in one click. Privacy & Local-Only Data: Zero tracking, no analytics, no persistent background scripts. Snippets stay strictly in your local browser via chrome.storage.local. PERMISSIONS EXPLAINED activeTab & scripting: used strictly to insert your selected payload into the currently focused field when you click Insert. Never runs silently in the background. storage: saves your custom snippets and folders locally on your machine. host_permissions (api.gumroad.com): used only when you click "Verify" to confirm a Pro license key purchase. No other network requests are made.