I spent hours making a web scanner not be a web scanner

The obvious way to scan a website is to send the URL to a server and let the server do the ugly work.

Trawl does not get that luxury.

One of the rules I have tried to keep since the first version is that everything happens on your machine. No files uploaded, no URLs sent to me, no remote API quietly doing the interesting part.

That became significantly harder when I added web reconnaissance.

The scanner that had to stay local

Browsers are deliberately terrible at crawling arbitrary websites. CORS, networking restrictions, and a dozen other sensible security decisions get in the way.

So I ended up building a small local scanner and shipping it as a GitHub release. Installation is a one-line winget command.

Once it is running, Trawl detects it automatically. The interface changes live, asks for a URL, and the scanner starts digging through the site for things that probably should not be public: hidden files, exposed secrets, interesting endpoints, and other CTF-shaped mistakes.

Nothing leaves the machine.

That sentence took far longer to make true than it looks.

AI helped with writing and refactoring parts of it, but most of the time disappeared into figuring out how the browser, local process, networking, detection, and UI should talk to each other without turning Trawl into the server-backed app I specifically did not want to build.

So I built a website designed to be broken

Testing a recon scanner against random real sites is a terrible test.

So I made my own mock CTF site instead.

It has challenges from easy through expert, with deliberately hidden files and secrets for Trawl to discover. I now have a controlled target where I know exactly what should be found, which makes false positives and missed findings much harder to hide.

I also improved the Vigenère decoder while I was in there.

The feature list sounds small: better decoder, local scanner, test site.

The amount of plumbing underneath it absolutely was not.