Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
1
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by @tangent ×
  • mediumPGN-10405

    Shipper API exposes courier phone numbers via nested include parameter

    A single sample and the range arithmetic for the id space were provided; no bulk retrieval was performed.

    Parcelo@tangentExposure of Sensitive Information04 Oct 2026triage 38hresolved 10.6d
    $1,800
    Resolved
Hacktivity
Connecting
  • Bounty paidParcelo@tangent
    Shipper API exposes courier phone numbers via nested include parameter
    medium
    $1,800
All disclosed reports →