Bug bounty program · HackerOne
Most upvoted reports57
- #365271ValidAnalysedRemote code execution on Basecamp.comBasecamp · Command and Code Injection · 2020 · needs: a user account · OS command injection, Unsafe file upload$5,000417votes
- #982291ValidAnalysedHEY.com email stored XSSBasecamp · Cross-site Scripting · 2020 · needs: no account · Stored XSS, HTML injection, CSRF$5,000360votes
- #1211724ValidAnalysedHTTP Request Smuggling via HTTP/2Basecamp · Injection and Smuggling · 2021 · needs: not clear from the report · Request smuggling$7,500300votes
- #2107680ValidAWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in BasecampBasecamp · Information Disclosure · 2023$8,868248votes
- #2516732ValidAccount takeover via insecure intent handlingBasecamp · Deserialization and Object Injection · 2024 · Medium–136votes
- #1018037Valida very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of serviceBasecamp · Denial of Service · 2020$1,000132votes
- #3329310ValidImproper bot-authentication allows to impersonate any user when sending messages in a roomBasecamp · Authentication · 2025 · High$2,000128votes
- #1020371ValidUser can upload files even after closing his accountBasecamp · Authentication · 2021–124votes
- #2012659ValidSpam & Clearance checks disabled with existing referenced Message-IDBasecamp · Access Control · 2026 · Low$250123votes
- #1372667ValidAble to steal bearer token from deep linkBasecamp · Authentication · 2022$6,337110votes
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.