Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
1
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @hex_tide ×
  • mediumPGN-10421

    Webhook signing secret rotation leaves previous secret valid indefinitely

    Rotated secrets were kept for a 24h grace window that was never enforced; a 30-day-old secret still verified.

    Ledgerline@hex_tideInsufficient Session Expiration10 Oct 2026triage 7.5hresolved 5.8d
    $3,000
    Resolved
Hacktivity
Connecting
  • Bounty paidLedgerline@hex_tide
    Webhook signing secret rotation leaves previous secret valid indefinitely
    medium
    $3,000
All disclosed reports →