Every decision, on the record.
Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.
- criticalPGN-10471
Password reset email array accepts two recipients when body is sent as JSON
The form-encoded reset endpoint also accepted JSON; an array value for email delivered the reset link to both addresses. Victim account was a second researcher account.
$24,000Resolved - criticalPGN-10433
Electron renderer escapes sandbox through embed preview protocol handler
A crafted embed URL reached a privileged protocol handler from the renderer. Proof launched the calculator on the researcher's own machine.
$28,000Resolved - mediumPGN-10411
Stored XSS in shared template title renders in admin audit log
Template titles were escaped in the editor but inserted as HTML in the workspace audit view that admins open.
$2,200Resolved - mediumPGN-10355
GraphQL alias batching bypasses per-operation rate limit on invite mutation
Two hundred aliased invite mutations in one request were counted as one operation.
Quillnote@kestrel_0xImproper Restriction of Excessive Authentication Attempts18 Sept 2026triage 27hresolved 8.2d$1,500Resolved - criticalPGN-10324
Symlink inside workspace import archive reads server configuration
The import worker extracted archives with symlinks intact. The proof read the worker's own environment file and nothing else.
$26,000Resolved
- Password reset email array accepts two recipients when body is sent as JSONcritical$24k
- Stored XSS in shared template title renders in admin audit logmedium$2,200
- GraphQL alias batching bypasses per-operation rate limit on invite mutationmedium$1,500