Skip to content

Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
com.basecamp.bc3 Webview Javascript Injection and JS bridge takeoverAnalysed#1343300	Valid	Cross-site Scripting	High	2022-09-23	–	21
Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonceAnalysed#3981292	Valid	Cross-site Scripting	High	2026-10-28	–	27
One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML#3943339	Valid	Cross-site Scripting	High	2026-10-02	–	49
Possible DOM XSS on app.hey.comAnalysed#1010132	Valid	Cross-site Scripting	High	2020-10-27	–	68
Stored XSS on trix editor version 2.1.1Analysed#2521419	Valid	Cross-site Scripting	High	2024-11-04	$1,000	76
stored XSS in hey.com message contentAnalysed#988272	Valid	Cross-site Scripting	Medium	2020-10-31	–	80
DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeoverAnalysed#3608199	Valid	Cross-site Scripting	High	2026-04-14	–	82
Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer BypassAnalysed#3581911	Valid	Cross-site Scripting	Low	2026-07-14	$337	89
HEY.com email stored XSSAnalysed#982291	Valid	Cross-site Scripting	Critical	2020-10-27	$5,000	360

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.