Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
3
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by program:quillnote ×
  • criticalPGN-10471

    Password reset email array accepts two recipients when body is sent as JSON

    The form-encoded reset endpoint also accepted JSON; an array value for email delivered the reset link to both addresses. Victim account was a second researcher account.

    Quillnote@kestrel_0xImproper Authorization25 Oct 2026triage 18hresolved 4.9d
    $24,000
    Resolved
  • criticalPGN-10433

    Electron renderer escapes sandbox through embed preview protocol handler

    A crafted embed URL reached a privileged protocol handler from the renderer. Proof launched the calculator on the researcher's own machine.

    Quillnote@ptr_nullImproper Control of Dynamically-Managed Code Resources13 Oct 2026triage 17hresolved 9.9d
    $28,000
    Resolved
  • criticalPGN-10324

    Symlink inside workspace import archive reads server configuration

    The import worker extracted archives with symlinks intact. The proof read the worker's own environment file and nothing else.

    Quillnote@n0ctisImproper Link Resolution Before File Access08 Sept 2026triage 13hresolved 7.8d
    $26,000
    Resolved
Hacktivity
Connecting
  • Bounty paidQuillnote@kestrel_0x
    Password reset email array accepts two recipients when body is sent as JSON
    critical
    $24k
  • Bounty paidQuillnote@ptr_null
    Electron renderer escapes sandbox through embed preview protocol handler
    critical
    $28k
  • Bounty paidQuillnote@n0ctis
    Symlink inside workspace import archive reads server configuration
    critical
    $26k
All disclosed reports →