Hacktivity
Every decision, on the record.
Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.
Disclosed
1
Paid in this view
$665k
Filtered by program:ledgerline ×
- mediumPGN-10421
Webhook signing secret rotation leaves previous secret valid indefinitely
Rotated secrets were kept for a 24h grace window that was never enforced; a 30-day-old secret still verified.
$3,000Resolved
Hacktivity
Connecting- Webhook signing secret rotation leaves previous secret valid indefinitelymedium$3,000