v1.3.3 - Quarry VRC

v1.3.3 - HackerOne onboarding and program scope management

The first clean public release of Quarry VRC: a zero-dependency, containerized console for independent vulnerability research with first-class HackerOne integration, built to pair with an agentic AI. Python 3.12 standard library and one HTML page; SQLite/FTS5; Docker.

Features

• HackerOne integration. Sync your programs, scopes, reports, states, bounties, payout splits and triage threads from the API, and file a finished report to a program with one click - no copy-paste into the web form.
• Program scope management. Track every program with its scope and rules of engagement. A Visibility column shows public / private / clear straight from HackerOne, and a screenshot-conceal toggle blurs the identity of your private programs so a demo shot never leaks which ones you are in.
• Add-program picker. Search every program your credential can see on HackerOne - including the private and invited ones that never appear in your reports - and onboard one, with its policy and scopes filled in immediately.
• Tracker, Leads and Targets. Every report with state, bounty, CWE, impact and payout split; a lead workflow (open, confirmed, ready, submitted, awarded, plus parked and killed) over plain Markdown on disk; in-scope assets mapped to the local workspaces your leads are filed against.
• Advisory feeds. Configurable RSS/Atom feeds (CISA and VulDB by default; bring your own) parsed into Vendor / Product / Type columns and cross-referenced against your reports.
• Payload library. A searchable clone of PayloadsAllTheThings, one row per documented block.
• Program hacktivity tile. Pick which program's public activity feed the dashboard watches.
• Agentic-AI-native. Every lead, note and payload is Markdown on disk, and a Bearer-token API lets external scripts and agents query the console without a browser session.

Fixes

• The Advisories and Payloads tabs (and their dashboard tallies) now populate on first boot instead of reading zero: the container seeds the advisory feeds and the payload arsenal in the background.
• The hacktivity program picker lists programs A-Z and defaults to a real program, dropping the confusing empty "Credential program" option.
• The Advisories table no longer prints a single jumbled Product field or repeats the CVE in the title; it splits into Vendor / Product / Type and adds a Source column.
• The redundant global redact button is hidden on the Programs tab, where the conceal toggle already covers privacy.

Security

• A leak scanner gates every change. scripts/check-no-private-data.sh (run before every push, and in CI via .github/workflows/no-private-data.yml) refuses operator-private data - home paths, LAN IPs, real report ids, private handles, credentials - from reaching the repo. The build ships with zero operator data.
• Configurable password policy. QUARRY_MIN_PASSWORD_LENGTH (default 12) sets the minimum for the admin bootstrap and any later change.
• Standard hardening throughout: IP allow-list checked before auth, TLS on first boot, PBKDF2-HMAC auth, write-only secrets, and a strict default-src 'none' CSP.

Upgrade notes

• docker compose pull && docker compose up -d. Your database, leads, config and credentials live on Docker volumes, so upgrading never touches your data. First boot seeds the advisory feeds and the payload library in the background (a few seconds); connect your HackerOne credential in Integrations to populate the Tracker and enable submit.