Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Improper bot-authentication allows to impersonate any user when sending messages in a roomAnalysed#3329310 | Valid | Authentication | High | 2025-11-21 | $2,000 | 128 |
| a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of serviceAnalysed#1018037 | Valid | Denial of Service | High | 2020-11-10 | $1,000 | 132 |
| Account takeover via insecure intent handlingAnalysed#2516732 | Valid | Deserialization and Object Injection | Medium | 2024-05-30 | – | 136 |
| AWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in BasecampAnalysed#2107680 | Valid | Information Disclosure | High | 2023-09-21 | $8,868 | 248 |
| HTTP Request Smuggling via HTTP/2Analysed#1211724 | Valid | Injection and Smuggling | Critical | 2021-08-27 | $7,500 | 300 |
| HEY.com email stored XSSAnalysed#982291 | Valid | Cross-site Scripting | Critical | 2020-10-27 | $5,000 | 360 |
| Remote code execution on Basecamp.comAnalysed#365271 | Valid | Command and Code Injection | Critical | 2020-11-26 | $5,000 | 417 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,182 analysed so far), which can be wrong. Data as of 2026-11-15.