Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
2
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @n0ctis ×
  • criticalPGN-10361

    Duplicate: SAML assertion wrapping on connect broker

    Duplicate of a report submitted 2026-09-19T22:04Z. The reporter received signal credit and the original timestamp was shown at triage.

    Ledgerline@n0ctisImproper Verification of Cryptographic Signature20 Sept 2026triage 4.5h
    —
    Duplicate
  • criticalPGN-10324

    Symlink inside workspace import archive reads server configuration

    The import worker extracted archives with symlinks intact. The proof read the worker's own environment file and nothing else.

    Quillnote@n0ctisImproper Link Resolution Before File Access08 Sept 2026triage 13hresolved 7.8d
    $26,000
    Resolved
Hacktivity
Connecting
  • duplicateLedgerline@n0ctis
    Duplicate: SAML assertion wrapping on connect broker
    critical
    20 Sept 2026
  • Bounty paidQuillnote@n0ctis
    Symlink inside workspace import archive reads server configuration
    critical
    $26k
All disclosed reports →