Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
3
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @saltmarsh ×
  • highPGN-10307· undisclosed

    Treasury export job runs with the requesting user's SAML attributes from a stale assertion

    Under remediation.

    Ledgerline@saltmarshInsufficient Session Expiration08 Nov 2026triage 7.5h
    —
    Triaged
  • criticalPGN-10482

    SAML assertion accepted after signature element is relocated under a wrapped Response

    A second Assertion placed before the signed one was processed by the relying-party parser while the signature check ran against the original. Proof used two researcher tenants.

    Stratos ID@saltmarshImproper Verification of Cryptographic Signature29 Oct 2026triage 3.5hresolved 4.3d
    $96,000
    Resolved
  • highPGN-10416· undisclosed

    Open-banking consent screen approves scopes beyond those displayed

    Not disclosed. Private program.

    Tessera Bank@saltmarshImproper Authorization08 Oct 2026triage 15hresolved 8.9d
    $20,000
    Resolved
Hacktivity
Connecting
  • TriagedLedgerline@saltmarsh
    Treasury export job runs with the requesting user's SAML attributes from a stale assertion
    high
    5d ago
  • Bounty paidStratos ID@saltmarsh
    SAML assertion accepted after signature element is relocated under a wrapped Response
    critical
    $96k
  • Bounty paidTessera Bank@saltmarsh
    Open-banking consent screen approves scopes beyond those displayed
    high
    $20k
All disclosed reports →