Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
32
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
  • lowPGN-10392

    Control-plane gRPC gateway reflects internal service address in error on malformed metadata

    Paid at Low because the address was reachable from the gateway in a follow-up probe; otherwise it would have been informative.

    Orbitstack@vesper.shExposure of Sensitive Information30 Sept 2026triage 6.5hresolved 2.6d
    $1,200
    Resolved
  • highPGN-10387

    Mass assignment on team invite sets owner role via nested attributes

    The invite endpoint blocked role_id at the top level but accepted it under attributes.membership.

    Ledgerline@hex_tideImproperly Controlled Modification of Dynamically-Determined Object Attributes28 Sept 2026triage 6.4hresolved 5.3d
    $9,500
    Resolved
  • mediumPGN-10380

    Deep link in driver app leaks session token to arbitrary host via redirect

    The in-app browser forwarded the bearer token on cross-origin redirects initiated from a trusted deep link.

    Voltgrid@mokurenURL Redirection to Untrusted Site26 Sept 2026triage 20hresolved 6.1d
    $2,800
    Resolved
  • highPGN-10374

    Cache deception on 404 under /account/ leaks CSRF token to shared cache

    The 404 page embedded the per-session token and was cached by path suffix.

    Kiln Games@deadbeef_Web Cache Deception24 Sept 2026triage 35hresolved 11.5d
    $5,000
    Resolved
  • lowPGN-10368

    Bridge IMAP IDLE handler accepts unauthenticated NOOP that resets rate limiter

    Accepted at Low with a demonstrated 10x increase in login attempts per minute against a researcher account.

    Nimbus Mail@ptr_nullImproper Restriction of Excessive Authentication Attempts22 Sept 2026triage 4.3hresolved 2.9d
    $600
    Resolved
  • criticalPGN-10361

    Duplicate: SAML assertion wrapping on connect broker

    Duplicate of a report submitted 2026-09-19T22:04Z. The reporter received signal credit and the original timestamp was shown at triage.

    Ledgerline@n0ctisImproper Verification of Cryptographic Signature20 Sept 2026triage 4.5h
    —
    Duplicate
  • mediumPGN-10355

    GraphQL alias batching bypasses per-operation rate limit on invite mutation

    Two hundred aliased invite mutations in one request were counted as one operation.

    Quillnote@kestrel_0xImproper Restriction of Excessive Authentication Attempts18 Sept 2026triage 27hresolved 8.2d
    $1,500
    Resolved
  • criticalPGN-10349

    HelixVault withdraw path skips share recomputation after emergency pause lift

    Reproduced on a mainnet fork with a Foundry test; the top of the critical band was paid without negotiation.

    Helixpay@glasswingIncorrect Calculation15 Sept 2026triage 5.5hresolved 6.9d
    $75,000
    Resolved
  • lowPGN-10342

    Informative: version banner on docs origin

    Closed as informative within three hours; no crossing of a trust boundary was shown.

    Orbitstack@tangentExposure of Sensitive Information14 Sept 2026triage 3h
    —
    Informative
  • highPGN-10336

    Courier app accepts server-signed delivery proof for a different parcel id

    The signature covered the courier id and timestamp but not the parcel id.

    Parcelo@sableImproper Validation of Integrity Check Value12 Sept 2026triage 43hresolved 15.8d
    $6,000
    Resolved
  • highPGN-10330

    OIDC back-channel logout token accepted without aud check across tenants

    A logout token minted for tenant A terminated sessions in tenant B. Both tenants were researcher-owned.

    Stratos ID@nullwaveImproper Authentication10 Sept 2026triage 2.6hresolved 3.3d
    $25,000
    Resolved
  • criticalPGN-10324

    Symlink inside workspace import archive reads server configuration

    The import worker extracted archives with symlinks intact. The proof read the worker's own environment file and nothing else.

    Quillnote@n0ctisImproper Link Resolution Before File Access08 Sept 2026triage 13hresolved 7.8d
    $26,000
    Resolved
page 2 of 2
Newer
Hacktivity
Connecting
  • Bounty paidOrbitstack@vesper.sh
    Control-plane gRPC gateway reflects internal service address in error on malformed metadata
    low
    $1,200
  • Bounty paidLedgerline@hex_tide
    Mass assignment on team invite sets owner role via nested attributes
    high
    $9,500
  • Bounty paidVoltgrid@mokuren
    Deep link in driver app leaks session token to arbitrary host via redirect
    medium
    $2,800
  • Bounty paidKiln Games@deadbeef_
    Cache deception on 404 under /account/ leaks CSRF token to shared cache
    high
    $5,000
  • Bounty paidNimbus Mail@ptr_null
    Bridge IMAP IDLE handler accepts unauthenticated NOOP that resets rate limiter
    low
    $600
  • duplicateLedgerline@n0ctis
    Duplicate: SAML assertion wrapping on connect broker
    critical
    20 Sept 2026
All disclosed reports →