Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
2
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @sable ×
  • criticalPGN-10439· undisclosed

    FHIR $everything operation returns documents across seeded test clinics

    Not disclosed. Private program.

    Meridian Health@sableImproper Authorization15 Oct 2026triage 22hresolved 12.1d
    $32,000
    Resolved
  • highPGN-10336

    Courier app accepts server-signed delivery proof for a different parcel id

    The signature covered the courier id and timestamp but not the parcel id.

    Parcelo@sableImproper Validation of Integrity Check Value12 Sept 2026triage 43hresolved 15.8d
    $6,000
    Resolved
Hacktivity
Connecting
  • Bounty paidMeridian Health@sable
    FHIR $everything operation returns documents across seeded test clinics
    critical
    $32k
  • Bounty paidParcelo@sable
    Courier app accepts server-signed delivery proof for a different parcel id
    high
    $6,000
All disclosed reports →