Hacktivity
Every decision, on the record.
Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.
Disclosed
26
Paid in this view
$665k
- lowPGN-10368
Bridge IMAP IDLE handler accepts unauthenticated NOOP that resets rate limiter
Accepted at Low with a demonstrated 10x increase in login attempts per minute against a researcher account.
Nimbus Mail@ptr_nullImproper Restriction of Excessive Authentication Attempts22 Sept 2026triage 4.3hresolved 2.9d$600Resolved - mediumPGN-10355
GraphQL alias batching bypasses per-operation rate limit on invite mutation
Two hundred aliased invite mutations in one request were counted as one operation.
Quillnote@kestrel_0xImproper Restriction of Excessive Authentication Attempts18 Sept 2026triage 27hresolved 8.2d$1,500Resolved - criticalPGN-10349
HelixVault withdraw path skips share recomputation after emergency pause lift
Reproduced on a mainnet fork with a Foundry test; the top of the critical band was paid without negotiation.
$75,000Resolved - highPGN-10330
OIDC back-channel logout token accepted without aud check across tenants
A logout token minted for tenant A terminated sessions in tenant B. Both tenants were researcher-owned.
$25,000Resolved - criticalPGN-10324
Symlink inside workspace import archive reads server configuration
The import worker extracted archives with symlinks intact. The proof read the worker's own environment file and nothing else.
$26,000Resolved
page 2 of 2
Hacktivity
Connecting- Bridge IMAP IDLE handler accepts unauthenticated NOOP that resets rate limiterlow$600
- GraphQL alias batching bypasses per-operation rate limit on invite mutationmedium$1,500
- HelixVault withdraw path skips share recomputation after emergency pause liftcritical$75k
- OIDC back-channel logout token accepted without aud check across tenantshigh$25k