Hacktivity
Every decision, on the record.
Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.
Disclosed
2
Paid in this view
$665k
Filtered by @kestrel_0x ×
- criticalPGN-10471
Password reset email array accepts two recipients when body is sent as JSON
The form-encoded reset endpoint also accepted JSON; an array value for email delivered the reset link to both addresses. Victim account was a second researcher account.
$24,000Resolved - mediumPGN-10355
GraphQL alias batching bypasses per-operation rate limit on invite mutation
Two hundred aliased invite mutations in one request were counted as one operation.
Quillnote@kestrel_0xImproper Restriction of Excessive Authentication Attempts18 Sept 2026triage 27hresolved 8.2d$1,500Resolved
Hacktivity
Connecting- Password reset email array accepts two recipients when body is sent as JSONcritical$24k
- GraphQL alias batching bypasses per-operation rate limit on invite mutationmedium$1,500