loading
Compare QuicDraw baseline GET vs concurrent HTTP/3 race traffic, then correlate race evidence you can retest.
Baseline vs concurrent responses, plus report.json.
An HTTPS URL that speaks HTTP/3. Default https://cloudflare-quic.com/.
Sends a normal request, then the same request as concurrent HTTP/3 streams, and compares the two responses.
HTTP/3 (QUIC) race bugs show up as stream and body deltas under concurrent load that a single GET never surfaces. Operators need a baseline versus race fan-out, plus a retest delta when the QUIC stack or app changes.
This is a standing check for continuous security testing. You set an HTTPS/h3 URL, run BHUSA 2026 Arsenal QuicDraw once as a baseline GET and once with concurrent race (-tr), diff the two, and correlate findings. Demo default is cloudflare-quic.com.
It sits next to transport-facing appsec graphs such as SSRF Scanner. This Collection unit is the QuicDraw race path: edit Seed; both scanners read url-file (leave the url string empty).
-tr 12) runs the concurrent Quic-Fin-Sync race.https://cloudflare-quic.com/. Edit Seed; both scanners read that file via url-file.-tr 12 on the race leg. Raise it on Scan · QuicDraw race.Sample shape from the report pack on the demo URL (illustrative, not a live KPI).
| kind | title | severity | note |
|---|---|---|---|
| finding | Baseline vs race stream or body delta | medium | null |
| inventory | null | null | HTTP/3 URL observed in baseline and race legs |
| retest_delta | null | null | Schedule re-runs after QUIC or app changes |
No. Both legs are QuicDraw nodes on the graph. Edit Seed; they read url-file. Leave the url string empty.
cloudflare-quic.com is the public QuicDraw demo target for smoke. Replace it before you treat results as yours.
The report emits retest_delta.jsonl so scheduled re-runs can surface race posture change after stack upgrades.
Get a personalized demo
A 30-minute walkthrough. We map the platform to your stack and answer pricing and deployment questions for your environment.