Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
1
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @deadbeef_ ×
  • highPGN-10374

    Cache deception on 404 under /account/ leaks CSRF token to shared cache

    The 404 page embedded the per-session token and was cached by path suffix.

    Kiln Games@deadbeef_Web Cache Deception24 Sept 2026triage 35hresolved 11.5d
    $5,000
    Resolved
Hacktivity
Connecting
  • Bounty paidKiln Games@deadbeef_
    Cache deception on 404 under /account/ leaks CSRF token to shared cache
    high
    $5,000
All disclosed reports →