Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Cross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonceAnalysed#3981292	Valid	Cross-site Scripting	High	2026-10-28	–	27
Open redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindow#3972760	Valid	Open Redirect	Medium	2026-10-15	–	33
A third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_optionAnalysed#3999856	Valid	Access Control	High	2026-10-30	–	33
Cross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhookAnalysed#3979217	Valid	Authentication	High	2026-10-30	–	34
Ordinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addresses#4035023	Valid	Access Control	High	2026-10-20	–	44
One-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTML#3943339	Valid	Cross-site Scripting	High	2026-10-02	–	49
launchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp APIAnalysed#3955956	Valid	Authentication	High	2026-10-30	–	49
Improper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosureAnalysed#3543475	Valid	Access Control	Low	2026-04-14	–	53
Launchpad file read leaks production keysAnalysed#3962925	Valid	File and Path Handling	Critical	2026-10-28	$9,337	55
Unauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosureAnalysed#3467641	Valid	Insecure Direct Object Reference	Low	2026-03-16	$100	76
DOM XSS in `fizzy.do` import filename preview enables one-click victim account takeoverAnalysed#3608199	Valid	Cross-site Scripting	High	2026-04-14	–	82
Stored XSS on Trix Editor version latest (2.1.16) - Sanitizer BypassAnalysed#3581911	Valid	Cross-site Scripting	Low	2026-07-14	$337	89
Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivityAnalysed#3764217	Valid	Access Control	Medium	2026-07-04	–	104
Spam & Clearance checks disabled with existing referenced Message-IDAnalysed#2012659	Valid	Access Control	Low	2026-01-21	$250	123

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.