Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
1
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @mokuren ×
  • mediumPGN-10380

    Deep link in driver app leaks session token to arbitrary host via redirect

    The in-app browser forwarded the bearer token on cross-origin redirects initiated from a trusted deep link.

    Voltgrid@mokurenURL Redirection to Untrusted Site26 Sept 2026triage 20hresolved 6.1d
    $2,800
    Resolved
Hacktivity
Connecting
  • Bounty paidVoltgrid@mokuren
    Deep link in driver app leaks session token to arbitrary host via redirect
    medium
    $2,800
All disclosed reports →