v1.4.1 - Response Header Hardening And A Security Response Standard

The first CodeQL code-scanning batch on the repo is triaged and closed. Fourteen alerts were false positives, dismissed with a written reason on each; three were real and are fixed here, alongside a new standard and a contributor front door for how security findings are handled from now on.

Security

• PR #20 - response header values are stripped of CR/LF at the single choke point in the request handler, so a guessed MIME type or a Content-Disposition filename from a browse path can no longer inject headers or split the response (CWE-113).
• PR #24 - the no-private-data workflow runs with a least-privilege token (contents: read), which is all it needs to check out and scan.

Docs

• PR #25 - adds a CONTRIBUTING front door and a security response standard (claim and self-assign, triage, dismissal with a retained record, fixing under the PR conventions), and separates contributor docs from the user-facing report and lead standards.
• PR #27 - extends the security response standard to externally reported vulnerabilities: private intake, validate and dupe-check before opening a draft advisory, a CVE request, and a "what is safe to publish" rule.
• PR #28 - retires the root CLAUDE.md and consolidates the contributor process into CONTRIBUTING.md, so the repo root carries no dev-only agent file.

Upgrade notes

Pull and rebuild. No configuration, data or API changes, and nothing an operator must do.

v1.4.0 - Evidence Capture, HackerOne Invitations And Collaborations, And Public Hunting Standards

v1.4.0 - Evidence Capture, HackerOne Invitations And Collaborations, And Public Hunting Standards

This release adds two substantial contributor features, browser-and-OS screenshot capture with an evidence timeline and HackerOne invitation, collaboration and bounty-split management over the GraphQL API, alongside a compact Tracker privilege badge, the first public, vendor-neutral report and lead standards any hunter can adopt, and a complete user manual documenting every feature.

Features

• PR #6 - captures request and response renders from Caido and Burp and full-screen grabs from the OS, records an evidence timeline and a scope-filtered proxy feed, and can draft a report and attach files, reachable from new server routes and a CLI.
• PR #7 - lists and accepts or rejects HackerOne program invitations, accepts report-collaborator invitations, invites a collaborator and sets a bounty split, over a stdlib GraphQL client and a new Integrations-tab card; the browser session cookie is stored write-only and masked.
• PR #5 - the Tracker PRIV column now renders a one-letter badge, N, L or H, with High in red, so the column packs tighter while the full word stays in the hover title.
• PR #8 - a new standards/ folder ships vendor-neutral report and lead standards so any Quarry hunter can adopt the same report shape and lead lifecycle.

Fixes

• PR #6 - the attachment upload no longer crashes when the API returns a single object instead of a list.
• PR #7 - the invitation lists return a clean session-expired message instead of a 500 when HackerOne answers with a null user.

Docs

• PR #13 - a complete user manual, docs/USER_GUIDE.md, one comprehensive document covering every feature, tab and workflow end to end; the README links to it.
• PR #18 - the contributor guide now documents the change-type PR prefixes, feat:, fix:, docs: and chore:, with the branch carrying the same prefix, so the history and PR list read uniformly.

Upgrade notes

• The report-intent attachment flow behind --attach and the GraphQL field and mutation names used for invitations and collaborations are not yet verified against a live HackerOne API and may need adjustment; both are documented in-code as follow-ups.
• Inside the container, point the capture backends at the host by setting CAIDO_URL and BURP_URL to http://host.docker.internal:<port>; OS screen capture runs on the host only.

Contributors

• @matty69v - PR #6, PR #7

v1.3.4 - application code moved under core/

v1.3.4 - Application code moved under core/

Repository housekeeping, with no functional or runtime change: the application code moves out of a cluttered root into a dedicated core/ folder.

Housekeeping

• Modules relocated to core/. server.py, common.py, auth.py, ingest.py, h1.py, advisories.py, hacktivity.py, payloads.py and schema.sql now live under core/; the root holds only project files (Dockerfile, docker-compose.yml, docker-entrypoint.sh, README.md, LICENSE, VERSION, config.example.json).
• Every runtime path preserved. core/common.py anchors schema.sql beside the code and static/, config, the database, uploads and TLS at the repository root, so the container layout is byte-for-byte what v1.3.3 shipped.
• Build wiring updated. docker-entrypoint.sh and scripts/sync-payloads.sh now reference core/.

Upgrade notes

• Pull and recreate: docker compose pull && docker compose up -d.
• Nothing else to do - no data, config or volume changes, and the paths inside the running image are identical to v1.3.3.

v1.3.3 - Quarry VRC

v1.3.3 - HackerOne onboarding and program scope management

The first clean public release of Quarry VRC: a zero-dependency, containerized console for independent vulnerability research with first-class HackerOne integration, built to pair with an agentic AI. Python 3.12 standard library and one HTML page; SQLite/FTS5; Docker.

Features

• HackerOne integration. Sync your programs, scopes, reports, states, bounties, payout splits and triage threads from the API, and file a finished report to a program with one click - no copy-paste into the web form.
• Program scope management. Track every program with its scope and rules of engagement. A Visibility column shows public / private / clear straight from HackerOne, and a screenshot-conceal toggle blurs the identity of your private programs so a demo shot never leaks which ones you are in.
• Add-program picker. Search every program your credential can see on HackerOne - including the private and invited ones that never appear in your reports - and onboard one, with its policy and scopes filled in immediately.
• Tracker, Leads and Targets. Every report with state, bounty, CWE, impact and payout split; a lead workflow (open, confirmed, ready, submitted, awarded, plus parked and killed) over plain Markdown on disk; in-scope assets mapped to the local workspaces your leads are filed against.
• Advisory feeds. Configurable RSS/Atom feeds (CISA and VulDB by default; bring your own) parsed into Vendor / Product / Type columns and cross-referenced against your reports.
• Payload library. A searchable clone of PayloadsAllTheThings, one row per documented block.
• Program hacktivity tile. Pick which program's public activity feed the dashboard watches.
• Agentic-AI-native. Every lead, note and payload is Markdown on disk, and a Bearer-token API lets external scripts and agents query the console without a browser session.

Fixes

• The Advisories and Payloads tabs (and their dashboard tallies) now populate on first boot instead of reading zero: the container seeds the advisory feeds and the payload arsenal in the background.
• The hacktivity program picker lists programs A-Z and defaults to a real program, dropping the confusing empty "Credential program" option.
• The Advisories table no longer prints a single jumbled Product field or repeats the CVE in the title; it splits into Vendor / Product / Type and adds a Source column.
• The redundant global redact button is hidden on the Programs tab, where the conceal toggle already covers privacy.

Security

• A leak scanner gates every change. scripts/check-no-private-data.sh (run before every push, and in CI via .github/workflows/no-private-data.yml) refuses operator-private data - home paths, LAN IPs, real report ids, private handles, credentials - from reaching the repo. The build ships with zero operator data.
• Configurable password policy. QUARRY_MIN_PASSWORD_LENGTH (default 12) sets the minimum for the admin bootstrap and any later change.
• Standard hardening throughout: IP allow-list checked before auth, TLS on first boot, PBKDF2-HMAC auth, write-only secrets, and a strict default-src 'none' CSP.

Upgrade notes

• docker compose pull && docker compose up -d. Your database, leads, config and credentials live on Docker volumes, so upgrading never touches your data. First boot seeds the advisory feeds and the payload library in the background (a few seconds); connect your HackerOne credential in Integrations to populate the Tracker and enable submit.