Peregrine
Start hunting
Public beta · 10 of 12 escrowed

Bug bounty,
without the black hole.

Peregrine is the platform for researchers who are done waiting on silent queues. Every program shows its triage clock in public, funds its bounties in escrow before launch, and shows a duplicate its receipt.

Browse programs Launch a program
In escrow
$7.85M
Median triage
8.5h
Open queue
128
Paid to researchers
$24.6M
all time, across all programs
Held in escrow
$7.85M
10 funded programs
Median bounty
$13.5k
resolved and paid, last 90 days
Resolved in 90 days
37%
655 of 1792 reports
Right now

The queue is public.
So is who is clearing it.

Disclosed reports, triage decisions and payouts stream here as they happen. Click through any item to the program's live response metrics.

Median triage
8.5h
measured from disclosures
Median to bounty
8d
across paid programs
Hunters active
20
with a valid report this quarter
Open hacktivity
Hacktivity
Connecting
  • Bounty paidStratos ID@saltmarsh
    SAML assertion accepted after signature element is relocated under a wrapped Response
    critical
    $96k
  • Bounty paidOrbitstack@ovis
    Cross-tenant secret read via node-local metadata proxy in shared edge pool
    critical
    $85k
  • Bounty paidQuillnote@kestrel_0x
    Password reset email array accepts two recipients when body is sent as JSON
    critical
    $24k
  • Bounty paidHelixpay@rook
    Issuing API lets a sandbox key approve authorizations on a live card program it does not own
    critical
    $60k
  • Bounty paidVoltgrid@nullwave
    Settlement amount mutated after signature via delimiter-free field concatenation
    high
    $16k
  • Bounty paidNimbus Mail@mirabel
    JMAP blob download ignores mailbox ACL for shared calendars
    high
    $11k
  • Bounty paidKiln Games@yara.v
    Store checkout race duplicates limited cosmetic on concurrent redeem
    high
    $6,500
  • Bounty paidParcelo@fennel
    HTTP/2 to HTTP/1.1 downgrade desync on courier API edge allows request queue poisoning
    high
    $7,000
All disclosed reports →
Why hunters switch

Every platform says it respects researchers. Peregrine puts it in the interface.

The failures that make hunters quit are structural: invisible queues, unfunded programs, duplicate black boxes. Each one has a product answer here, not a policy page.

Clocks both sides can see

Every program publishes its median time-to-triage and time-to-bounty, its live queue depth, and a commitment it is held to. Miss it, and the program's response score drops where every hunter can see it.

ProgramMedian → commitment
  • Stratos ID5h / 24h
  • Orbitstack6h / 24h
  • Quillnote18h / 36h
  • Parcelo31h / 72h
Clocks update from the triage queue, both sides see the same number.

Funded before launch

Paid programs escrow their pool before the first report lands. Unfunded programs are labelled, not hidden.

EscrowedHelixpay
$910,000
covers 12 critical payouts at top of band

Duplicates show their receipts

A duplicate decision comes with the original submission timestamp and partial signal credit. You never have to take it on faith.

  1. 2026-09-19 22:04Z
    Original report received · PGN-10359
  2. 2026-09-20 14:30Z
    Your report · marked duplicate
    You see the original timestamp. You keep signal credit. No guessing.

Scope you can pull into your tools

Signed, machine-readable scope with a diff feed. Your recon stack knows the moment an asset is added or capped.

$ pgn scope pull ledgerline
✓ signed by Ledgerline · key 7f3a…c21e
{
  "asset": "api.ledgerline.com",
  "max_severity": "critical",
  "changed": "+connect.ledgerline.com"
}

Collaboration splits

Invite a co-researcher on any report and set the split before triage. Payout, signal and reputation follow the percentages.

@nullwave
60%
@ilse
40%

Paid within 48 hours of resolution

Bounties release from escrow automatically on resolution. Bank transfer, card payout or stablecoin, in 40+ currencies, with the FX rate shown before you choose.

Mediation in 72 hours, by people who have hunted

Severity disputes escalate to a rotating panel of top-ranked researchers and program-side engineers. Decisions are published with their reasoning.

Programs

Hunt where the money is already on the table.

Sorted by total paid. Every card shows the critical band, the median triage time and whether the pool is escrowed, so you can decide in ten seconds whether a program deserves your weekend.

All 12 programs
Stratos ID
Identity
Public

Identity provider and passkey infrastructure for 3,000 SaaS products.

Critical
$30k – $120k
Median triage
5h
Response efficiency99%
Escrowed · $2.1Mqueue 1
Orbitstack
Cloud infrastructure
Public

Managed Kubernetes and edge compute for regulated workloads.

Critical
$25k – $100k
Median triage
6h
Response efficiency99%
Escrowed · $1.25Mqueue 2
Helixpay
Fintech
Public

Card issuing and embedded wallets for marketplaces.

Critical
$20k – $75k
Median triage
14h
Response efficiency94%
Escrowed · $910kqueue 11
Quillnote
Productivity
Public

Collaborative documents and knowledge bases for 40M users.

Critical
$10k – $30k
Median triage
18h
Response efficiency89%
Escrowed · $310kqueue 23
Ledgerline
Fintech
Public

Treasury and payment rails for mid-market finance teams.

Critical
$15k – $50k
Median triage
9h
Response efficiency97%
Escrowed · $420kqueue 4
Nimbus Mail
Communications
Public

Encrypted email and calendar for 9M privacy-focused users.

Critical
$12k – $45k
Median triage
8h
Response efficiency97%
Escrowed · $380kqueue 3
For companies

The best researchers go where the clock is public. Give them a reason to pick you.

Programs on Peregrine compete on response time and funding, in public. That is uncomfortable on day one and the whole point by month three: the top of the leaderboard hunts where it gets paid fast.

Talk to us
Launch
Pay per valid report

For teams running their first program. We triage, you fix.

  • Managed triage with a 24h first-response commitment
  • Escrow account and automated payouts
  • Scope-as-code and signed policy
  • Public response metrics
Scale
Most programs
Platform fee + bounties

For security teams that run their own triage and want the tooling.

  • Bring your own triage team, our queue and SLAs
  • Collaboration splits and mediation panel
  • API and webhooks into your tracker
  • Private and invite-only programs
Enterprise
Talk to us

Regulated industries, multiple business units, custom legal.

  • Dedicated escrow and audit trail
  • Custom safe-harbor language
  • Hunter vetting tiers and ID verification
  • On-prem evidence storage
Join the beta

Hunt where the clock is public and the money is real.

Bring your existing reputation. Export it when you leave. Peregrine is built so that you never have to.

Start hunting Submit a report