Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
1
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @mirabel ×
  • highPGN-10457

    JMAP blob download ignores mailbox ACL for shared calendars

    Attachments on events in a calendar shared read-only could be fetched by blob id after the share was revoked.

    Nimbus Mail@mirabelMissing Authorization20 Oct 2026triage 6.4hresolved 3.8d
    $11,000
    Resolved
Hacktivity
Connecting
  • Bounty paidNimbus Mail@mirabel
    JMAP blob download ignores mailbox ACL for shared calendars
    high
    $11k
All disclosed reports →