Quarry VRC

No entries match these filters. Clear filters

1. v1.5.0 Aug 19, 2026 · issue 059

   Quarry VRC v1.5.0 adds an incremental HackerOne poller, card/list views, and a leads_by_class Dashboard tile.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.5.0 https://github.com/skraft9/quarry-vrc.git
   # already have the repo? check out this version:
   $ git checkout v1.5.0

   └──▷ USE IT
   Disable the built-in poller timer and drive HackerOne report polling from your own external scheduler (e.g. a cron job).
   .env copy

   QUARRY_POLL_MINUTES=0

   Check the current leads-by-class breakdown from the stats API to populate dashboards or feed downstream tooling.
   copy

   $ curl -s https://<quarry-host>/api/stats | jq '.leads_by_class'

   Reduce poll frequency to every 30 minutes to lower HackerOne API request volume in a low-traffic deployment.
   .env copy

   QUARRY_POLL_MINUTES=30

   • Adds QUARRY_POLL_MINUTES environment variable to tune the incremental HackerOne poller interval (default: 15 minutes); set to 0 to disable the built-in timer and drive polls from an external scheduler.
   • Adds a leads_by_class breakdown to the /api/stats endpoint, powering a new Leads by class tile on the Dashboard.
   • Adds the incremental poller core/h1_watch.py that detail-fetches only reports whose HackerOne list-endpoint change signals moved, recording state and bounty transitions as events to keep Tracker badges, the report-update feed, and bounty alerts current between full syncs.
   • Adds a card and list view across Leads, Tracker, and Advisories with a persisted toggle, equal-height cards with bottom-flush metadata, and PRIV plus C/I/A impact badges consistent with table mode.
   • Adds a profile menu — a single account icon dropdown carrying the signed-in user, theme choice, and log out — replacing three separate top-bar chips.

   +3 more show less

   • Adds a name filter and sortable columns to the Files tab.
   • Adds a working retest-window control to Settings, replacing the previously unavailable cadence card.
   • Adds a Search toggle and compact Sort control to Leads, Tracker, Programs, Targets, Payloads, and Regression, and applies the shared status-chip legend to Regression buckets.

   8 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !The anticipated (hand-recorded, unconfirmed-award) feature is removed from the Tracker, the report detail, and the Dashboard.
   • !The manual New report form is replaced with a How to submit link to the API-submit guide.
2. v1.4.2 Aug 18, 2026 · release notes

   Quarry VRC v1.4.2 hardens screenshot backends and deny-list casing

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.4.2 https://github.com/skraft9/quarry-vrc.git
   # already have the repo? check out this version:
   $ git checkout v1.4.2

   └──▷ TRY IT
   Configure Quarry VRC to use a local Burp instance for screenshots via environment variables
   copy

   $ export BURP_URL=http://localhost:8080
   export CAIDO_URL=http://localhost:9000

   • path_denied in core/common.py now matches case-insensitively, preventing re-cased secrets from bypassing the deny-list
   • Screenshot and evidence-feed endpoints (/api/screenshot and /api/evidence/feed) read backend hosts from CAIDO_URL and BURP_URL environment variables instead of request bodies

   2 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !Callers passing caido_url or burp_url in the screenshot or evidence-feed request body must now set CAIDO_URL and BURP_URL in the environment instead
3. v1.4.0 Aug 10, 2026 · issue 059

   Quarry VRC v1.4.0 adds evidence capture with timeline, HackerOne GraphQL collaboration management, and vendor-neutral hunting standards.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.4.0 https://github.com/skraft9/quarry-vrc.git
   # already have the repo? check out this version:
   $ git checkout v1.4.0

   └──▷ HOW TO FIND IT
   Adopt the vendor-neutral report and lead standards shipped with Quarry for consistent reporting across a team.
   📍In the Quarry VRC UI, go to the Integrations tab, then review and configure your HackerOne session cookie in the new HackerOne card; reference the standards in the standards/ folder for report shape and lead lifecycle guidance.
   • Adds CAIDO_URL and BURP_URL environment variables to point capture backends at Caido and Burp proxy instances (use http://host.docker.internal:<port> inside a container) for request/response and full-screen OS screenshot capture.
   • Adds --attach CLI flag to the report-intent flow for attaching files to drafted reports.
   • New server routes and CLI for evidence capture: records an evidence timeline, a scope-filtered proxy feed, and supports drafting and attaching files to reports.
   • New Integrations-tab card and stdlib GraphQL client for HackerOne: list, accept, or reject program invitations; accept report-collaborator invitations; invite collaborators and set bounty splits; browser session cookie stored write-only and masked.
   • New standards/ folder ships vendor-neutral report and lead standards any Quarry hunter can adopt for a consistent report shape and lead lifecycle.

   +1 more show less

   • Tracker PRIV column now renders a compact one-letter badge (N, L, or H), with High displayed in red and the full word retained in the hover title.

   6 details in Everything

4. v1.3.3 Aug 7, 2026 · issue 059

   Quarry VRC v1.3.3 launches with HackerOne sync, program scope management, advisory feeds, payload library, and a Bearer-token API for agentic-AI access.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.3.3 https://github.com/skraft9/quarry-vrc.git
   # already have the repo? check out this version:
   $ git checkout v1.3.3

   └──▷ TRY IT
   Set a stronger minimum password length before bootstrapping the admin account in a production deployment.
   copy

   $ QUARRY_MIN_PASSWORD_LENGTH=20
   docker compose up -d

   Run the leak scanner locally before pushing to ensure no operator-private data (home paths, LAN IPs, report IDs, credentials) is committed.
   copy

   $ bash scripts/check-no-private-data.sh

   • Adds QUARRY_MIN_PASSWORD_LENGTH environment variable (default 12) to enforce a configurable minimum password length for admin bootstrap and subsequent password changes.
   • Adds scripts/check-no-private-data.sh and CI workflow .github/workflows/no-private-data.yml to gate every commit, refusing home paths, LAN IPs, real report IDs, private handles, and credentials from reaching the repository.
   • Provides a Bearer-token API so external scripts and agents can query the console without a browser session.
   • Syncs HackerOne programs, scopes, reports, states, bounties, payout splits, and triage threads from the HackerOne API, and enables filing a finished report to a program without copy-pasting into the web form.
   • Adds an add-program picker that searches every program a credential can see on HackerOne — including private and invited programs — and onboards one with its policy and scopes immediately populated.

   +6 more show less

   • Tracks programs with a Visibility column showing public / private / clear sourced from HackerOne, plus a screenshot-conceal toggle that blurs private program identities in demo screenshots.
   • Adds a Tracker showing every report with state, bounty, CWECWECommon Weakness Enumeration, a catalog of recurring software and hardware weakness types. It describes classes of mistakes, such as injection, rather than individual vulnerability instances., impact, and payout split; a lead workflow with states open, confirmed, ready, submitted, awarded, parked, and killed; and in-scope assets mapped to local workspaces.
   • Adds configurable RSS/Atom advisory feeds (CISA and VulDB by default, user-replaceable) parsed into Vendor / Product / Type columns and cross-referenced against your reports.
   • Includes a searchable payload library cloned from PayloadsAllTheThings, one row per documented block.
   • Adds a program hacktivity tile on the dashboard that watches whichever program's public activity feed the operator selects.
   • Ships standard hardening: IP allow-list checked before auth, TLS on first boot, PBKDF2-HMACHMACA keyed hash that proves a message came from someone holding a shared secret and was not altered. Webhooks and API request signing commonly use it. auth, write-only secrets, and a strict default-src 'none' CSPCSPContent Security Policy: a browser security mechanism, standardized by the W3C, that lets a web server declare which sources of scripts, styles, and other resources a page may load, blocking injection attacks..

   11 details in Everything