Peregrine
Start hunting
← All programs
PublicIdentitySelf-triagedSafe harborcoordinated disclosure

Stratos ID

Identity provider and passkey infrastructure for 3,000 SaaS products.

Escrowed · $2.1Mlaunched 11 Apr 2022
pgn scope pull stratos-id
Submit report
Response, measured
last 90 days
Median triage
5h
commitment 24h
Median to bounty
3d
commitment 7d
Queue right now
1
121 received · 49 resolved
Response score
99%
within commitment
Triage: median vs commitment5h / 24h
Bounty: median vs commitment3d / 7d
Escrow
$2,100,000

Held by Peregrine, released automatically on resolution. Covers 17 critical payouts at top of band.

Paid all-time
$6.93M
Hunters thanked
203
Bounty table
  • critical$30k – $120k
  • high$10k – $30k
  • medium$2,500 – $10k
  • low$500 – $2,500

Bands are floors and ceilings the program is held to. Mediation can move a report within a band, never below the floor of its agreed severity.

Scope · 4 assets
signed · diff feed available
AssetTypeMax severityEligibleNote
*.stratos.idwebcritical yesHosted login, admin, dashboard
api.stratos.idapicritical yesManagement and OIDC endpoints
github.com/stratos-id/*sourcecritical yesAll public SDKs
Passkey relying-party serviceinfrastructurecritical yesWebAuthn verification
Out of scope
  • Account takeover that requires the victim's password
  • Phishing-only scenarios
Policy

Any authentication bypass that yields a session for an account the researcher does not control is Critical and paid at the top of band. Signature-handling findings in SAML or JWT are prioritised for same-day triage.

#oidc#saml#webauthn#sso
Recent reports · 3
Filter hacktivity →
  • criticalPGN-10482

    SAML assertion accepted after signature element is relocated under a wrapped Response

    A second Assertion placed before the signed one was processed by the relying-party parser while the signature check ran against the original. Proof used two researcher tenants.

    @saltmarshImproper Verification of Cryptographic Signature29 Oct 2026triage 3.5hresolved 4.3d
    $96,000
    Resolved
  • criticalPGN-10428

    Passkey ceremony accepts attestation for a different relying-party id under a wildcard origin

    rpIdHash was compared against a wildcard-expanded set that included a sibling subdomain the researcher controlled.

    @ilseImproper Authentication11 Oct 2026triage 3.3hresolved 4.5d
    $70,000
    Resolved
  • highPGN-10330

    OIDC back-channel logout token accepted without aud check across tenants

    A logout token minted for tenant A terminated sessions in tenant B. Both tenants were researcher-owned.

    @nullwaveImproper Authentication10 Sept 2026triage 2.6hresolved 3.3d
    $25,000
    Resolved
Top hunters here
  1. 1@saltmarsh$96k1 resolved
  2. 2@ilse$70k1 resolved
  3. 3@nullwave$25k1 resolved