Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed

Paid in this view

$665k

Severityall critical high medium low

Stateall resolved triaged new duplicate informative

Filtered by @sable ×

highPGN-10336
Courier app accepts server-signed delivery proof for a different parcel id
The signature covered the courier id and timestamp but not the parcel id.
Parcelo @sableImproper Validation of Integrity Check Value12 Sept 2026triage 43hresolved 15.8d
$6,000
Resolved

Hacktivity

Connecting

Bounty paidParcelo @sable
Courier app accepts server-signed delivery proof for a different parcel id
high
$6,000

All disclosed reports →

Every decision, on the record.

Courier app accepts server-signed delivery proof for a different parcel id