Peregrine
Start hunting
← All programs
PublicFintechSelf-triagedSafe harborcoordinated disclosure

Ledgerline

Treasury and payment rails for mid-market finance teams.

Escrowed · $420klaunched 12 Mar 2024
pgn scope pull ledgerline
Submit report
Response, measured
last 90 days
Median triage
9h
commitment 24h
Median to bounty
6d
commitment 12d
Queue right now
4
142 received · 61 resolved
Response score
97%
within commitment
Triage: median vs commitment9h / 24h
Bounty: median vs commitment6d / 12d
Escrow
$420,000

Held by Peregrine, released automatically on resolution. Covers 8 critical payouts at top of band.

Paid all-time
$1.84M
Hunters thanked
212
Bounty table
  • critical$15k – $50k
  • high$5,000 – $15k
  • medium$1,000 – $5,000
  • low$250 – $1,000

Bands are floors and ceilings the program is held to. Mediation can move a report within a band, never below the floor of its agreed severity.

Scope · 6 assets
signed · diff feed available
AssetTypeMax severityEligibleNote
app.ledgerline.comwebcritical yesProduction web application
api.ledgerline.comapicritical yesREST + webhooks, v2 and v3
connect.ledgerline.comwebcritical yesSAML / OIDC broker
com.ledgerline.treasurymobilehigh yesAndroid, latest release only
github.com/ledgerline/sdk-jssourcehigh yesPublic SDK
status.ledgerline.comweblow noThird-party hosted
Out of scope
  • Rate limiting without a demonstrated second-order impact
  • Clickjacking on pages with no state-changing action
  • Self-XSS
  • Findings from automated scanners without a working proof
Policy

Ledgerline funds its pool before every scope expansion and publishes triage and payout timers for every report. Severity follows CVSS 4.0 with business-impact overrides documented per asset. Duplicates receive signal credit and the original submission timestamp is shown to the duplicate reporter.

#payments#saml#webhooks#api
Recent reports · 4
Filter hacktivity →
  • highPGN-10307· undisclosed

    Treasury export job runs with the requesting user's SAML attributes from a stale assertion

    Under remediation.

    @saltmarshInsufficient Session Expiration08 Nov 2026triage 7.5h
    —
    Triaged
  • mediumPGN-10421

    Webhook signing secret rotation leaves previous secret valid indefinitely

    Rotated secrets were kept for a 24h grace window that was never enforced; a 30-day-old secret still verified.

    @hex_tideInsufficient Session Expiration10 Oct 2026triage 7.5hresolved 5.8d
    $3,000
    Resolved
  • highPGN-10387

    Mass assignment on team invite sets owner role via nested attributes

    The invite endpoint blocked role_id at the top level but accepted it under attributes.membership.

    @hex_tideImproperly Controlled Modification of Dynamically-Determined Object Attributes28 Sept 2026triage 6.4hresolved 5.3d
    $9,500
    Resolved
  • criticalPGN-10361

    Duplicate: SAML assertion wrapping on connect broker

    Duplicate of a report submitted 2026-09-19T22:04Z. The reporter received signal credit and the original timestamp was shown at triage.

    @n0ctisImproper Verification of Cryptographic Signature20 Sept 2026triage 4.5h
    —
    Duplicate
Top hunters here
  1. 1@hex_tide$12.5k2 resolved