Quarry VRC — The Cyber Toolchain

Quarry VRC v1.5.0

Wed, 19 Aug 2026 01:52:29 GMT

Quarry VRC v1.5.0 adds an incremental HackerOne poller, card/list views, and a `leads_by_class` Dashboard tile. • Adds `QUARRY_POLL_MINUTES` environment variable to tune the incremental HackerOne poller interval (default: 15 minutes); set to `0` to disable the built-in timer and drive polls from an external scheduler. • Adds a `leads_by_class` breakdown to the `/api/stats` endpoint, powering a new Leads by class tile on the Dashboard. • Adds the incremental poller `core/h1_watch.py` that detail-fetches only reports whose HackerOne list-endpoint change signals moved, recording state and bounty transitions as events to keep Tracker badges, the report-update feed, and bounty alerts current between full syncs. • Adds a card and list view across Leads, Tracker, and Advisories with a persisted toggle, equal-height cards with bottom-flush metadata, and PRIV plus C/I/A impact badges consistent with table mode. • Adds a profile menu — a single account icon dropdown carrying the signed-in user, theme choice, and log out — replacing three separate top-bar chips. • Adds a name filter and sortable columns to the Files tab. • Adds a working retest-window control to Settings, replacing the previously unavailable cadence card. • Adds a Search toggle and compact Sort control to Leads, Tracker, Programs, Targets, Payloads, and Regression, and applies the shared status-chip legend to Regression buckets. Breaking changes: • The anticipated (hand-recorded, unconfirmed-award) feature is removed from the Tracker, the report detail, and the Dashboard. • The manual New report form is replaced with a 'How to submit' link to the API-submit guide. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/quarry-vrc

Quarry VRC v1.4.0

Mon, 10 Aug 2026 22:01:11 GMT

Quarry VRC v1.4.0 adds evidence capture with timeline, HackerOne GraphQL collaboration management, and vendor-neutral hunting standards. • Adds `CAIDO_URL` and `BURP_URL` environment variables to point capture backends at Caido and Burp proxy instances (use `http://host.docker.internal:` inside a container) for request/response and full-screen OS screenshot capture. • Adds `--attach` CLI flag to the report-intent flow for attaching files to drafted reports. • New server routes and CLI for evidence capture: records an evidence timeline, a scope-filtered proxy feed, and supports drafting and attaching files to reports. • New Integrations-tab card and stdlib GraphQL client for HackerOne: list, accept, or reject program invitations; accept report-collaborator invitations; invite collaborators and set bounty splits; browser session cookie stored write-only and masked. • New `standards/` folder ships vendor-neutral report and lead standards any Quarry hunter can adopt for a consistent report shape and lead lifecycle. • Tracker PRIV column now renders a compact one-letter badge (N, L, or H), with High displayed in red and the full word retained in the hover title. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/quarry-vrc

Quarry VRC v1.3.3

Fri, 07 Aug 2026 01:31:39 GMT

Quarry VRC v1.3.3 launches with HackerOne sync, program scope management, advisory feeds, payload library, and a Bearer-token API for agentic-AI access. • Adds `QUARRY_MIN_PASSWORD_LENGTH` environment variable (default 12) to enforce a configurable minimum password length for admin bootstrap and subsequent password changes. • Adds `scripts/check-no-private-data.sh` and CI workflow `.github/workflows/no-private-data.yml` to gate every commit, refusing home paths, LAN IPs, real report IDs, private handles, and credentials from reaching the repository. • Provides a Bearer-token API so external scripts and agents can query the console without a browser session. • Syncs HackerOne programs, scopes, reports, states, bounties, payout splits, and triage threads from the HackerOne API, and enables filing a finished report to a program without copy-pasting into the web form. • Adds an add-program picker that searches every program a credential can see on HackerOne — including private and invited programs — and onboards one with its policy and scopes immediately populated. • Tracks programs with a Visibility column showing public / private / clear sourced from HackerOne, plus a screenshot-conceal toggle that blurs private program identities in demo screenshots. • Adds a Tracker showing every report with state, bounty, CWE, impact, and payout split; a lead workflow with states open, confirmed, ready, submitted, awarded, parked, and killed; and in-scope assets mapped to local workspaces. • Adds configurable RSS/Atom advisory feeds (CISA and VulDB by default, user-replaceable) parsed into Vendor / Product / Type columns and cross-referenced against your reports. • Includes a searchable payload library cloned from PayloadsAllTheThings, one row per documented block. • Adds a program hacktivity tile on the dashboard that watches whichever program's public activity feed the operator selects. • Ships standard hardening: IP allow-list checked before auth, TLS on first boot, PBKDF2-HMAC auth, write-only secrets, and a strict `default-src 'none'` CSP. Full history on Cyber Toolchain: https://cybertoolchain.io/tools/quarry-vrc