Peregrine
Start hunting
← Leaderboard
#3 · 90 days#3 · all timeLongest streak

@kestrel_0x

🇳🇬member since 30 Sept 2022·IDOR · GraphQL · Mobile
All disclosed reports
Reputation
15,210
Signal
6.8
avg severity of valid reports
Impact
27.5
bounty-weighted
Earned, 90d
$69k
Earned, all time
$431k
Valid reports
173
44-week streak
Disclosed reports · 2
$25.5k shown
  • criticalPGN-10471

    Password reset email array accepts two recipients when body is sent as JSON

    The form-encoded reset endpoint also accepted JSON; an array value for email delivered the reset link to both addresses. Victim account was a second researcher account.

    QuillnoteImproper Authorization25 Oct 2026triage 18hresolved 4.9d
    $24,000
    Resolved
  • mediumPGN-10355

    GraphQL alias batching bypasses per-operation rate limit on invite mutation

    Two hundred aliased invite mutations in one request were counted as one operation.

    QuillnoteImproper Restriction of Excessive Authentication Attempts18 Sept 2026triage 27hresolved 8.2d
    $1,500
    Resolved
Programs
Portable record

Every outcome on this profile is signed by the program that decided it. Export the record and verify it anywhere.

pgn record export @kestrel_0x --sign