Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
2
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by program:ledgerline ×
  • highPGN-10307· undisclosed

    Treasury export job runs with the requesting user's SAML attributes from a stale assertion

    Under remediation.

    Ledgerline@saltmarshInsufficient Session Expiration08 Nov 2026triage 7.5h
    —
    Triaged
  • highPGN-10387

    Mass assignment on team invite sets owner role via nested attributes

    The invite endpoint blocked role_id at the top level but accepted it under attributes.membership.

    Ledgerline@hex_tideImproperly Controlled Modification of Dynamically-Determined Object Attributes28 Sept 2026triage 6.4hresolved 5.3d
    $9,500
    Resolved
Hacktivity
Connecting
  • TriagedLedgerline@saltmarsh
    Treasury export job runs with the requesting user's SAML attributes from a stale assertion
    high
    5d ago
  • Bounty paidLedgerline@hex_tide
    Mass assignment on team invite sets owner role via nested attributes
    high
    $9,500
All disclosed reports →