One long page. Nine sections.

01Install

One pipx command. The CLI is 128 KB. No analysis code, no proprietary IP runs on your machine — the agent lives server-side; the CLI is a thin orchestrator that drives Chrome and ships captures upstream.

Supported Python: 3.11+ (the CLI vendors its own runtime via pipx, but a system Python in that range is recommended for compatibility with virtualenvs you might pipe scans into).

Verify the install:

What gets installed locally: the recon binary, a Chrome launcher, and a tiny capture proxy. What stays server-side: every LLM call, every validation request, every scrub rule, every blob.

02First scan

Three commands. The first picks a target; the second is you browsing like a human; the third is when you call it done.

The CLI:

1. asks you to pick an intent template (e.g. product_listing, search_results, reviews) — this tells the agent what kind of data you're after,
2. opens Chrome to the target URL with a capture proxy attached,
3. watches every request you trigger as you browse for ~2 minutes.

When you've clicked through the data you want, hit Ctrl+C in the terminal. The CLI flushes the captured traffic, scrubs sensitive values, uploads, and prints the report URL.

03What's in your report

Every report has the same shape. Verdict first, evidence in the middle, runnable starter code at the bottom.

04What we don't save

Section §4 is the load-bearing section of this guide for trust. It's specific on purpose. Vague claims ("we strip sensitive data") read as marketing; named fields read as engineering.

Scrubbing happens before the capture leaves your machine for long-term storage. The validation layer needs plaintext access transiently — see §5 — but the persisted blob is the scrubbed version.

05Security model

The honest framing. Read this once; we will not claim things we cannot back up.

# /user-guide §5

Encryption in transit:  All traffic between your machine and our servers
                        uses TLS 1.3.

Encryption at rest:    Captures are stored in AWS S3, encrypted with
                        AWS KMS (AES-256).

What's scrubbed:       Cookie values, Authorization headers, X-Api-Key,
                        X-Auth-Token, X-CSRF-Token, JWT-shaped strings,
                        and named session cookies are stripped before
                        long-term storage. (Full list in §4.)

What we do see:        We need plaintext access during validation
                        — that's how the agent confirms a library/proxy
                        combination actually works against the target.
                        We do NOT claim end-to-end encryption.

Who can read it:       browser-recon staff, when a support case
                        requires it, with audit logging.

Deletion:              Captures auto-delete at report expiry. The
                        report itself is also deleted at expiry.

06Pricing & credits

Four tiers. One trial. The full pricing page is at /pricing; the short version:

• Tester — $5/mo, 5 credits, reports live 2 weeks. One-time only per account, enforced server-side.
• Beginner — $10/mo, 12 credits, reports live 1 month.
• Pro — $20/mo, 30 credits, reports live 2 months.
• Pro Max — $60/mo, 100 credits, reports live 3 months.

Credits expire monthly. No rollover. The next month's grant overwrites the balance; it does not accumulate. A re-scan from an expired report costs the same 1 credit as a fresh scan.

2 free scans on activation. When we flip you from waitlist to active, you land with 2 free scans. They're independent of your tier purchase.

V1 is admin-granted; Stripe Checkout lands in V2 once first-cohort pricing has settled. To pay, just reply to your welcome email.

07Dashboard

The dashboard lives at /dashboard. What you see there:

• Credit balance — current month + the date your tier renews.
• Recent scans — every scan you've run, newest first. Each row links to its report.
• Per-report expiry — the stamped expires_at date for each report; downgrading later doesn't shorten it.
• Re-scan — one-click re-scan on expired or stale reports. Costs one credit.

You can also drop into /dashboard/data to see and delete your own scans + intent text — single source of truth for "what does browser-recon have about me."

08FAQ

09Troubleshooting

Common failure modes. If your symptom isn't here, reply to your welcome email.