surfacewatch.org · Developer Tools
5 items
Store & insert XSS/SQLi/SSRF payloads, recon commands & pentest report templates into any field in one click. Stop context-switching between notes apps, Gists, and browser tabs during penetration tests and bug bounty engagements. Recon Vault keeps your most-used XSS, SQLi, and SSRF payloads, recon one-liners, and vulnerability report templates one click away — right inside the page you're testing. WHO IT'S FOR Bug bounty hunters, penetration testers, red teamers, and application security engineers who are tired of re-typing the same payloads and recon commands during every assessment. FEATURES Instant One-Click Insert: Inject payloads directly into active form fields, target inputs, or report submission forms on any website. Dynamic Variable Placeholders: Use tags like {{TARGET}} or {{ENDPOINT}} in your payloads. Recon Vault shows a quick fill-in prompt on insertion, saving manual formatting time. 46 Built-In Snippets, All Free: Comes ready on install with real-world security testing payloads, reconnaissance commands, and vulnerability report templates covering the categories bug bounty hunters use most often. Keyboard-First Workflow: Press Cmd+Shift+K (Mac) or Ctrl+Shift+K (Windows) to instantly open the popup. Folder Filtering & Search: Rapidly search titles and snippet bodies or filter by category with a single click. Import & Export: Back up your entire snippet library to a JSON file, or restore/share it across machines in one click. Private & Local-Only: Zero tracking, no analytics, no accounts, no background scripts. Snippets stay strictly in your local browser via chrome.storage.local, and nothing is ever sent to a server. PERMISSIONS EXPLAINED activeTab & scripting: used strictly to insert your selected snippet into the currently focused field when you click Insert. Never runs silently in the background. storage: saves your snippets and folders locally on your machine. Nothing is sent anywhere.
Nov 2, 2026
rating_count is the Chrome Web Store ratings count, not a written-review count.
Media assets
Screenshots and videos on the listing.
Has promo video
Whether the listing includes at least one video.
Languages
Declared language locales.
Developer website
Listing exposes a developer website URL.
Contact email
Listing exposes a contact email.
Keyword in name
Case-insensitive substring match in the name.
Keyword in description
Case-insensitive substring match in the description.
Keyword occurrences in description
Count of case-insensitive occurrences in the description.
Category user-count percentile
Share of same-category extensions with fewer users (null if unknown).
These are transparent listing completeness / keyword signals, not a prediction of Chrome Web Store search ranking.