Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
2
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @hex_tide ×
  • mediumPGN-10421

    Webhook signing secret rotation leaves previous secret valid indefinitely

    Rotated secrets were kept for a 24h grace window that was never enforced; a 30-day-old secret still verified.

    Ledgerline@hex_tideInsufficient Session Expiration10 Oct 2026triage 7.5hresolved 5.8d
    $3,000
    Resolved
  • highPGN-10387

    Mass assignment on team invite sets owner role via nested attributes

    The invite endpoint blocked role_id at the top level but accepted it under attributes.membership.

    Ledgerline@hex_tideImproperly Controlled Modification of Dynamically-Determined Object Attributes28 Sept 2026triage 6.4hresolved 5.3d
    $9,500
    Resolved
Hacktivity
Connecting
  • Bounty paidLedgerline@hex_tide
    Webhook signing secret rotation leaves previous secret valid indefinitely
    medium
    $3,000
  • Bounty paidLedgerline@hex_tide
    Mass assignment on team invite sets owner role via nested attributes
    high
    $9,500
All disclosed reports →