Hacktivity
Every decision, on the record.
Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.
Disclosed
4
Paid in this view
$665k
Filtered by program:ledgerline ×
- highPGN-10307· undisclosed
Treasury export job runs with the requesting user's SAML attributes from a stale assertion
Under remediation.
—Triaged - mediumPGN-10421
Webhook signing secret rotation leaves previous secret valid indefinitely
Rotated secrets were kept for a 24h grace window that was never enforced; a 30-day-old secret still verified.
$3,000Resolved - highPGN-10387
Mass assignment on team invite sets owner role via nested attributes
The invite endpoint blocked role_id at the top level but accepted it under attributes.membership.
Ledgerline@hex_tideImproperly Controlled Modification of Dynamically-Determined Object Attributes28 Sept 2026triage 6.4hresolved 5.3d$9,500Resolved - criticalPGN-10361
Duplicate: SAML assertion wrapping on connect broker
Duplicate of a report submitted 2026-09-19T22:04Z. The reporter received signal credit and the original timestamp was shown at triage.
—Duplicate
Hacktivity
Connecting- Treasury export job runs with the requesting user's SAML attributes from a stale assertionhigh5d ago
- Webhook signing secret rotation leaves previous secret valid indefinitelymedium$3,000
- Mass assignment on team invite sets owner role via nested attributeshigh$9,500
- Duplicate: SAML assertion wrapping on connect brokercritical20 Sept 2026