Peregrine
Start hunting
Hacktivity

Every decision, on the record.

Resolved, duplicate and informative alike. Triage time and time-to-bounty are shown per report, because a platform that hides its misses is not measuring anything.

Disclosed
3
Paid in this view
$665k
Severityallcriticalhighmediumlow
Stateallresolvedtriagednewduplicateinformative
  • highPGN-10307· undisclosed

    Treasury export job runs with the requesting user's SAML attributes from a stale assertion

    Under remediation.

    Ledgerline@saltmarshInsufficient Session Expiration08 Nov 2026triage 7.5h
    —
    Triaged
  • mediumPGN-10312· undisclosed

    Fleet console session fixation via pre-auth cookie

    Under remediation.

    Axiom Robotics@yara.vSession Fixation07 Nov 2026triage 43h
    —
    Triaged
  • mediumPGN-10318· undisclosed

    Mobile banking PIN retry counter resets on app reinstall

    Not disclosed. Private program.

    Tessera Bank@quietcoilImproper Restriction of Excessive Authentication Attempts06 Nov 2026triage 8.3h
    $5,000
    Triaged
Hacktivity
Connecting
  • TriagedLedgerline@saltmarsh
    Treasury export job runs with the requesting user's SAML attributes from a stale assertion
    high
    5d ago
  • TriagedAxiom Robotics@yara.v
    Fleet console session fixation via pre-auth cookie
    medium
    4d ago
  • TriagedTessera Bank@quietcoil
    Mobile banking PIN retry counter resets on app reinstall
    medium
    $5,000
All disclosed reports →