Focus sessions
Pomodoro-style timed tests pinned to a target. Pause-aware, so abandoned minutes never count as work.
HuntFlow by xalgorix
Your local-first command center for penetration testing.
Track engagements, targets, test sessions, evidence, report drafts, and findings without spreadsheets or cloud lock-in.
Install
npx huntflow@latest No install. Runs once, opens in your browser.
01 / 12
Dashboard
Local vault overview: today’s focused time, active targets, evidence captured, and pending reports. Pick up the timer where you paused yesterday.
Features
Built around how pentesters actually work.
Ten focused tools that talk to each other, instead of ten browser tabs that don't.
Target tracker
Engagements with scope, priority, status, time per target and coverage rate — at a glance.
Markdown notes
Templates for SSRF, IDOR, XSS, RCE, auth bypass and more. Tags, code fences, instant search.
Recon assets
Subdomains, IPs, endpoints, params per target. Search across everything you have ever found.
Evidence canvas
A whiteboard for screenshots, requests and findings. Connect them visually so reports write themselves.
Stats and streaks
Year heatmap, weekly recap, hours tracked, vulnerability mix and the times of day you actually ship.
Pentest toolkit
Encoder/decoder, JWT, hash, random tokens and a scope validator. No more Alt-Tabbing to CyberChef.
Command palette
Cmd-K opens a fuzzy palette across every target, note, payload and finding. g-t to jump anywhere.
Offline first
Everything stored in your browser. No account required. Encrypted backups when you want them.
Pro
Cloud sync
Seamless real-time sync across every device you use. Resolves conflicts, keeps you fast.
Private by default
No login required for local use, no telemetry. Optional hosted account features stay isolated from your local workspace.
Runs from your terminal
Install via npm and serve the app on localhost. Works fully air-gapped — cloud sync just stays disabled.
Open core
Built by pentesters, for pentesters. The local-first core is free; Pro adds cloud sync and encrypted backups.
Pro feature
Real-time cloud sync — built for your pentest workspace.
HuntFlow Pro keeps your targets, sessions, notes, evidence and findings in sync across every device, in real time. Start a test on your laptop, finish it on your phone, write the report on a tablet — same data everywhere, always up to date.
- Sub-second updates pushed to every signed-in device. No refresh. No conflicts.
- End-to-end encrypted backups. Your evidence and notes are yours, full stop.
- Built on Convex. Operational-transform style merging means simultaneous edits never overwrite each other.
laptop · synced 2s ago
phone · live
- No. Everything except cloud sync works without signing in. Your data lives in your browser via IndexedDB and stays on your device. Sign in only when you want to sync across devices.
Quickstart
Run it locally.
HuntFlow ships as a local app. Start from npm, then export or back up your workspace from Settings.
npx huntflow@latest No install. Runs once, opens in your browser.
Start testing with a cleaner workspace.
Local-first pentest workflow management by xalgorix.