Docs
Start with Installing the Extension below if you just want it running. Everything past that assumes you've got a dashboard running somewhere too — local or deployed.
On this page
Getting started
Two pieces, built separately:
- The extension — Manifest V3, Svelte 5, built with Vite. Lives in your browser toolbar.
- The dashboard — SvelteKit 5 app backed by Neon Postgres. Runs locally or deployed to Vercel.
The dashboard needs to exist first — the extension talks to it, not the other way around. Deploy or run the dashboard, create an account, then set up the extension to point at it.
Installing the extension
Redline isn't on the Chrome Web Store or Firefox Add-ons yet, so this is a manual install — a few clicks, not a build step. If you'd rather build it from source instead, skip ahead to The extension.
Chrome or Edge
- Unzip the download — you should end up with a folder containing
manifest.jsonat its root. - Go to
chrome://extensions(Edge:edge://extensions). - Toggle Developer mode on — top-right corner in Chrome, bottom-left sidebar in Edge.
- Click Load unpacked, then select the unzipped folder (not the .zip itself).
- Redline's icon appears in the toolbar. If it's hidden, click the puzzle-piece icon and pin it for one-click access.
One thing this method doesn't give you: automatic updates. A new version means re-downloading and repeating step 4 — Chrome/Edge will pick up the change on the existing folder without you needing to remove and re-add it, as long as you overwrite the same folder rather than unzipping to a new one.
Firefox
- Unzip the download.
- Go to
about:debugging#/runtime/this-firefox. - Click Load Temporary Add-on, then select
manifest.jsoninside the unzipped folder.
The catch: Firefox only allows unsigned extensions to run temporarily — it's removed the moment you restart the browser, and you'd repeat these steps each time. That's a Firefox policy, not something this guide can work around; the only permanent fix is Mozilla signing it, which happens automatically once it's published to addons.mozilla.org. Until then, Chrome or Edge is the better choice if you want it to just stay installed.
The extension
Downloaded the prebuilt version above? Skip to The dashboard — this part's for building it from source instead, if you're modifying the code or don't trust a binary you didn't build yourself (reasonable, for a security tool).
From the extension/ folder:
npm install npm run build
Then follow the same Load unpacked steps above, pointing at the dist folder this produces instead of the downloaded zip's contents.
Open the extension's options page (right-click the toolbar icon → Options), and fill in your dashboard's URL and an API key. You'll generate that key from the dashboard in a minute — see below.
Once connected, the popup shows the payload library. It also reads whatever page you're on — forms, URL params, file params — and bumps the relevant categories to the top instead of making you scroll through all ten.
The dashboard
Register an account, then go to Settings. Two things need to happen before you can generate an API key: fill in your full name under Personal Information, and verify your email (click "Get verification link" — it's rate-limited to one request per 90 seconds, so don't mash it).
Once both are done, generate a key under API Keys and paste it into the extension's options page alongside the dashboard's URL. Hit "Test connection" there to confirm it's actually talking.
Everything in the dashboard is organized under Programs — a program is a bug bounty program or a private engagement. Targets, recon results, and findings all belong to a program.
Recon & findings
On a program's page, add a target domain, then run Subdomain recon (certificate-transparency lookups against crt.sh) or Fingerprint (reads response headers, cookies, and markup signatures to guess the stack — WordPress, Next.js, Laravel, that kind of thing).
Worth being clear about: recon results aren't findings. They're reference material. A finding is something you've actually flagged — either from the dashboard's "+ New finding" button, or from the extension's popup, where "Flag as finding" captures the payload you used and the page you were on.
By default, findings and recon from the extension land in your most recently created program. If you're running more than one engagement at once, set a specific program in the extension's options page instead of relying on that guess.
Reports
Every program has a "Download report" button that generates a PDF — cover page, summary by severity, then one page per finding with steps to reproduce, the payload used, and an impact section you fill in before submitting. Shaped for HackerOne or Bugcrowd, but it's just a PDF — attach it wherever you need to.
API reference
The extension talks to the dashboard over a small API, authenticated with Authorization: Bearer <api key>.
All under /api/extension/*:
GET /api/extension/ping Verifies the key. Returns the account email if valid.
GET /api/extension/programs Lists your programs — powers the extension's program picker.
POST /api/extension/findings Body: title, category, payloadUsed?, pageUrl?, notes?, programId?.
GET /api/extension/recon/subdomains?domain=&programId= Passive subdomain harvest via crt.sh.
GET /api/extension/recon/fingerprint?url=&programId= Tech fingerprint of a single URL.
FAQ
Does the extension check what I'm allowed to test?
No, on purpose. It's a reference tool, not a gatekeeper — the scope is your call, not the software's.
Can I self-host the dashboard?
Yes — that's the only way to run it. You'll need a Neon Postgres database and, optionally, a Brevo account for email verification.
Why isn't recon more aggressive — port scans, directory brute-force?
That needs a persistent worker, not a serverless function — a browser extension and a Vercel deployment can't run nmap. It's a deliberate scope decision, not an oversight.
Why isn't the extension on the Chrome Web Store?
Hasn't been submitted yet — see Installing the extension above for the manual-install path in the meantime. Store review for a security-testing tool with broad host permissions tends to take longer than average, which is expected, not a red flag.
What happens to my data?
It lives in whatever Neon database you point the dashboard at. Nobody else's Redline instance can see it.