Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
2
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
Filtered by program:quillnote ×
  • mediumPGN-10411

    Stored XSS in shared template title renders in admin audit log

    Template titles were escaped in the editor but inserted as HTML in the workspace audit view that admins open.

    Quillnote@lanternfishCross-site Scripting06 Oct 2026triage 25hresolved 8.3d
    $2,200
    Resolved
  • mediumPGN-10355

    GraphQL alias batching bypasses per-operation rate limit on invite mutation

    Two hundred aliased invite mutations in one request were counted as one operation.

    Quillnote@kestrel_0xImproper Restriction of Excessive Authentication Attempts18 Sept 2026triage 27hresolved 8.2d
    $1,500
    Resolved
Hacktivity
Connecting
  • Bounty paidQuillnote@lanternfish
    Stored XSS in shared template title renders in admin audit log
    medium
    $2,200
  • Bounty paidQuillnote@kestrel_0x
    GraphQL alias batching bypasses per-operation rate limit on invite mutation
    medium
    $1,500
All disclosed reports →