Skip to content

v1.4.0 - Evidence Capture, HackerOne Invitations And Collaborations, And Public Hunting Standards

Choose a tag to compare

View all tags
@skraft9 skraft9 released this 10 Aug 22:01
· 26 commits to main since this release
v1.4.0
258e337
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

v1.4.0 - Evidence Capture, HackerOne Invitations And Collaborations, And Public Hunting Standards

This release adds two substantial contributor features, browser-and-OS screenshot capture with an evidence timeline and HackerOne invitation, collaboration and bounty-split management over the GraphQL API, alongside a compact Tracker privilege badge, the first public, vendor-neutral report and lead standards any hunter can adopt, and a complete user manual documenting every feature.

Features

  • PR #6 - captures request and response renders from Caido and Burp and full-screen grabs from the OS, records an evidence timeline and a scope-filtered proxy feed, and can draft a report and attach files, reachable from new server routes and a CLI.
  • PR #7 - lists and accepts or rejects HackerOne program invitations, accepts report-collaborator invitations, invites a collaborator and sets a bounty split, over a stdlib GraphQL client and a new Integrations-tab card; the browser session cookie is stored write-only and masked.
  • PR #5 - the Tracker PRIV column now renders a one-letter badge, N, L or H, with High in red, so the column packs tighter while the full word stays in the hover title.
  • PR #8 - a new standards/ folder ships vendor-neutral report and lead standards so any Quarry hunter can adopt the same report shape and lead lifecycle.

Fixes

  • PR #6 - the attachment upload no longer crashes when the API returns a single object instead of a list.
  • PR #7 - the invitation lists return a clean session-expired message instead of a 500 when HackerOne answers with a null user.

Docs

  • PR #13 - a complete user manual, docs/USER_GUIDE.md, one comprehensive document covering every feature, tab and workflow end to end; the README links to it.
  • PR #18 - the contributor guide now documents the change-type PR prefixes, feat:, fix:, docs: and chore:, with the branch carrying the same prefix, so the history and PR list read uniformly.

Upgrade notes

  • The report-intent attachment flow behind --attach and the GraphQL field and mutation names used for invitations and collaborations are not yet verified against a live HackerOne API and may need adjustment; both are documented in-code as follow-ups.
  • Inside the container, point the capture backends at the host by setting CAIDO_URL and BURP_URL to http://host.docker.internal:<port>; OS screen capture runs on the host only.

Contributors

Contributors

matty69v
Assets 2
Loading