Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| HEY.com email stored XSSAnalysed#982291 | Valid | Cross-site Scripting | Critical | 2020-10-27 | $5,000 | 360 |
| Improper bot-authentication allows to impersonate any user when sending messages in a roomAnalysed#3329310 | Valid | Authentication | High | 2025-11-21 | $2,000 | 128 |
| Spam & Clearance checks disabled with existing referenced Message-IDAnalysed#2012659 | Valid | Access Control | Low | 2026-01-21 | $250 | 123 |
| Able to steal bearer token from deep linkAnalysed#1372667 | Valid | Authentication | High | 2022-03-27 | $6,337 | 110 |
| Any installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivityAnalysed#3764217 | Valid | Access Control | Medium | 2026-07-04 | – | 104 |
| Mutation Based Stored XSS on Trix Editor version latest (2.1.8)Analysed#2819573 | Valid | No weakness recorded | Critical | 2025-06-27 | – | 89 |
| Two click Account TakeoverAnalysed#3079738 | Valid | Deserialization and Object Injection | High | 2025-11-11 | – | 77 |
| Subdomain Takeover due to ████████ NS records at us-east4.37signals.comAnalysed#1342422 | Valid | Information Disclosure | Medium | 2021-09-17 | – | 77 |
| Information Disclosure .htaccess accesible for publicAnalysed#1241849 | Valid | No weakness recorded | Low | 2021-07-18 | – | 76 |
| Bypass of image rewriting / tracking blocker via srcsetAnalysed#1021885 | Valid | Information Disclosure | Medium | 2020-12-03 | $1,000 | 56 |
| Critical Data Breach - Big Data for all domainsAnalysed#2686225 | Valid | No weakness recorded | Medium | 2025-01-14 | – | 53 |
| Premium Email Address Check Bypass - HeyAnalysed#963774 | Valid | Input Validation and Logic | Medium | 2020-12-15 | – | 53 |
| Domain Takeover [3737signals.com]Analysed#1253926 | Valid | Input Validation and Logic | Low | 2021-08-13 | – | 48 |
| Error Page Content Spoofing or Text InjectionAnalysed#1245051 | Valid | Misconfiguration and Insecure Design | Low | 2021-07-14 | $100 | 45 |
| Information Disclosure of Garbage Collection Cycle 'Again'Analysed#1026196 | Valid | Information Disclosure | Low | 2020-12-16 | $100 | 41 |
| Information Disclosure of Garbage Collection CycleAnalysed#981796 | Valid | Information Disclosure | Low | 2020-11-04 | – | 33 |
| RCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.comAnalysed#1456063 | Valid | Deserialization and Object Injection | Low | 2022-04-26 | $100 | 30 |
| Lack of quarantine macOS attribute(com.apple.quarantine) leads multiple issues including RCEAnalysed#1019389 | Valid | No weakness recorded | Medium | 2021-04-22 | $250 | 29 |
| Unauthenticated request smuggling on launchpad.37signals.comAnalysed#867577 | Valid | Injection and Smuggling | Critical | 2020-10-28 | – | 27 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.