Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
7
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
  • mediumPGN-10312· undisclosed

    Fleet console session fixation via pre-auth cookie

    Under remediation.

    Axiom Robotics@yara.vSession Fixation07 Nov 2026triage 43h
    —
    Triaged
  • mediumPGN-10318· undisclosed

    Mobile banking PIN retry counter resets on app reinstall

    Not disclosed. Private program.

    Tessera Bank@quietcoilImproper Restriction of Excessive Authentication Attempts06 Nov 2026triage 8.3h
    $5,000
    Triaged
  • mediumPGN-10421

    Webhook signing secret rotation leaves previous secret valid indefinitely

    Rotated secrets were kept for a 24h grace window that was never enforced; a 30-day-old secret still verified.

    Ledgerline@hex_tideInsufficient Session Expiration10 Oct 2026triage 7.5hresolved 5.8d
    $3,000
    Resolved
  • mediumPGN-10411

    Stored XSS in shared template title renders in admin audit log

    Template titles were escaped in the editor but inserted as HTML in the workspace audit view that admins open.

    Quillnote@lanternfishCross-site Scripting06 Oct 2026triage 25hresolved 8.3d
    $2,200
    Resolved
  • mediumPGN-10405

    Shipper API exposes courier phone numbers via nested include parameter

    A single sample and the range arithmetic for the id space were provided; no bulk retrieval was performed.

    Parcelo@tangentExposure of Sensitive Information04 Oct 2026triage 38hresolved 10.6d
    $1,800
    Resolved
  • mediumPGN-10380

    Deep link in driver app leaks session token to arbitrary host via redirect

    The in-app browser forwarded the bearer token on cross-origin redirects initiated from a trusted deep link.

    Voltgrid@mokurenURL Redirection to Untrusted Site26 Sept 2026triage 20hresolved 6.1d
    $2,800
    Resolved
  • mediumPGN-10355

    GraphQL alias batching bypasses per-operation rate limit on invite mutation

    Two hundred aliased invite mutations in one request were counted as one operation.

    Quillnote@kestrel_0xImproper Restriction of Excessive Authentication Attempts18 Sept 2026triage 27hresolved 8.2d
    $1,500
    Resolved
Hacktivity
Connecting
  • TriagedAxiom Robotics@yara.v
    Fleet console session fixation via pre-auth cookie
    medium
    4d ago
  • TriagedTessera Bank@quietcoil
    Mobile banking PIN retry counter resets on app reinstall
    medium
    $5,000
  • Bounty paidLedgerline@hex_tide
    Webhook signing secret rotation leaves previous secret valid indefinitely
    medium
    $3,000
  • Bounty paidQuillnote@lanternfish
    Stored XSS in shared template title renders in admin audit log
    medium
    $2,200
  • Bounty paidParcelo@tangent
    Shipper API exposes courier phone numbers via nested include parameter
    medium
    $1,800
  • Bounty paidVoltgrid@mokuren
    Deep link in driver app leaks session token to arbitrary host via redirect
    medium
    $2,800
All disclosed reports →