Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
3
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by program:parcelo ×
  • highPGN-10444

    HTTP/2 to HTTP/1.1 downgrade desync on courier API edge allows request queue poisoning

    A CRLF in an H2 header value survived translation at the edge. Impact was framed as capture of the next researcher-owned request on the same connection.

    Parcelo@fennelHTTP Request Smuggling16 Oct 2026triage 46hresolved 13.3d
    $7,000
    Resolved
  • mediumPGN-10405

    Shipper API exposes courier phone numbers via nested include parameter

    A single sample and the range arithmetic for the id space were provided; no bulk retrieval was performed.

    Parcelo@tangentExposure of Sensitive Information04 Oct 2026triage 38hresolved 10.6d
    $1,800
    Resolved
  • highPGN-10336

    Courier app accepts server-signed delivery proof for a different parcel id

    The signature covered the courier id and timestamp but not the parcel id.

    Parcelo@sableImproper Validation of Integrity Check Value12 Sept 2026triage 43hresolved 15.8d
    $6,000
    Resolved
Hacktivity
Connecting
  • Bounty paidParcelo@fennel
    HTTP/2 to HTTP/1.1 downgrade desync on courier API edge allows request queue poisoning
    high
    $7,000
  • Bounty paidParcelo@tangent
    Shipper API exposes courier phone numbers via nested include parameter
    medium
    $1,800
  • Bounty paidParcelo@sable
    Courier app accepts server-signed delivery proof for a different parcel id
    high
    $6,000
All disclosed reports →