Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
5
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
  • mediumPGN-10421

    Webhook signing secret rotation leaves previous secret valid indefinitely

    Rotated secrets were kept for a 24h grace window that was never enforced; a 30-day-old secret still verified.

    Ledgerline@hex_tideInsufficient Session Expiration10 Oct 2026triage 7.5hresolved 5.8d
    $3,000
    Resolved
  • mediumPGN-10411

    Stored XSS in shared template title renders in admin audit log

    Template titles were escaped in the editor but inserted as HTML in the workspace audit view that admins open.

    Quillnote@lanternfishCross-site Scripting06 Oct 2026triage 25hresolved 8.3d
    $2,200
    Resolved
  • mediumPGN-10405

    Shipper API exposes courier phone numbers via nested include parameter

    A single sample and the range arithmetic for the id space were provided; no bulk retrieval was performed.

    Parcelo@tangentExposure of Sensitive Information04 Oct 2026triage 38hresolved 10.6d
    $1,800
    Resolved
  • mediumPGN-10380

    Deep link in driver app leaks session token to arbitrary host via redirect

    The in-app browser forwarded the bearer token on cross-origin redirects initiated from a trusted deep link.

    Voltgrid@mokurenURL Redirection to Untrusted Site26 Sept 2026triage 20hresolved 6.1d
    $2,800
    Resolved
  • mediumPGN-10355

    GraphQL alias batching bypasses per-operation rate limit on invite mutation

    Two hundred aliased invite mutations in one request were counted as one operation.

    Quillnote@kestrel_0xImproper Restriction of Excessive Authentication Attempts18 Sept 2026triage 27hresolved 8.2d
    $1,500
    Resolved
Hacktivity
Connecting
  • Bounty paidLedgerline@hex_tide
    Webhook signing secret rotation leaves previous secret valid indefinitely
    medium
    $3,000
  • Bounty paidQuillnote@lanternfish
    Stored XSS in shared template title renders in admin audit log
    medium
    $2,200
  • Bounty paidParcelo@tangent
    Shipper API exposes courier phone numbers via nested include parameter
    medium
    $1,800
  • Bounty paidVoltgrid@mokuren
    Deep link in driver app leaks session token to arbitrary host via redirect
    medium
    $2,800
  • Bounty paidQuillnote@kestrel_0x
    GraphQL alias batching bypasses per-operation rate limit on invite mutation
    medium
    $1,500
All disclosed reports →