Hacktivity
Every decision, on the record.
Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.
Disclosed
1
Paid in this view
$665k
Filtered by @kestrel_0x ×
- mediumPGN-10355
GraphQL alias batching bypasses per-operation rate limit on invite mutation
Two hundred aliased invite mutations in one request were counted as one operation.
Quillnote@kestrel_0xImproper Restriction of Excessive Authentication Attempts18 Sept 2026triage 27hresolved 8.2d$1,500Resolved
Hacktivity
Connecting- GraphQL alias batching bypasses per-operation rate limit on invite mutationmedium$1,500