Disclosed bug bounty reports

57 of 15,219 reports · $53,629 in bounties · 161 analysed so far

• #365271ValidAnalysedRemote code execution on Basecamp.comBasecamp · Command and Code Injection · 2020 · needs: a user account · OS command injection, Unsafe file upload$5,000417votes
• #982291ValidAnalysedHEY.com email stored XSSBasecamp · Cross-site Scripting · 2020 · needs: no account · Stored XSS, HTML injection, CSRF$5,000360votes
• #1211724ValidAnalysedHTTP Request Smuggling via HTTP/2Basecamp · Injection and Smuggling · 2021 · needs: not clear from the report · Request smuggling$7,500300votes
• #2107680ValidAWS keys and user cookie leakage via uninitialized memory leak in outdated librsvg version in BasecampBasecamp · Information Disclosure · 2023$8,868248votes
• #2516732ValidAccount takeover via insecure intent handlingBasecamp · Deserialization and Object Injection · 2024 · Medium–136votes
• #1018037Valida very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of serviceBasecamp · Denial of Service · 2020$1,000132votes
• #3329310ValidImproper bot-authentication allows to impersonate any user when sending messages in a roomBasecamp · Authentication · 2025 · High$2,000128votes
• #1020371ValidUser can upload files even after closing his accountBasecamp · Authentication · 2021–124votes
• #2012659ValidSpam & Clearance checks disabled with existing referenced Message-IDBasecamp · Access Control · 2026 · Low$250123votes
• #1372667ValidAble to steal bearer token from deep linkBasecamp · Authentication · 2022$6,337110votes
• #3764217ValidAny installed app can force immediate logout and persistent DOS of authenticated Basecamp sessions via unprotected exported StartActivityBasecamp · Access Control · 2026 · Medium–104votes
• #1104874ValidInsecure Bundler configuration fetching internal Gems (okra) from Rubygems.orgBasecamp · Command and Code Injection · 2021$5,000102votes
• #3581911ValidStored XSS on Trix Editor version latest (2.1.16) - Sanitizer BypassBasecamp · Cross-site Scripting · 2026 · Low$33789votes
• #2819573ValidMutation Based Stored XSS on Trix Editor version latest (2.1.8)Basecamp · No weakness recorded · 2025 · Critical–89votes
• #3608199ValidDOM XSS in `fizzy.do` import filename preview enables one-click victim account takeoverBasecamp · Cross-site Scripting · 2026 · High–82votes
• #988272Validstored XSS in hey.com message contentBasecamp · Cross-site Scripting · 2020–80votes
• #3079738ValidTwo click Account TakeoverBasecamp · Deserialization and Object Injection · 2025 · High–77votes
• #1342422ValidSubdomain Takeover due to ████████ NS records at us-east4.37signals.comBasecamp · Information Disclosure · 2021–77votes
• #3467641ValidUnauthenticated access to private files on app.fizzy.do via Active Storage URLs leads to information disclosureBasecamp · Insecure Direct Object Reference · 2026 · Low · no account (title)$10076votes
• #2521419ValidStored XSS on trix editor version 2.1.1Basecamp · Cross-site Scripting · 2024 · High$1,00076votes
• #1241849ValidInformation Disclosure .htaccess accesible for publicBasecamp · No weakness recorded · 2021–76votes
• #1010132ValidPossible DOM XSS on app.hey.comBasecamp · Cross-site Scripting · 2020–68votes
• #2553411ValidPath traversal in deeplink query parameter can expose any user's private info to a public directory (one click)Basecamp · File and Path Handling · 2024 · Medium–65votes
• #3445890ValidLink unfurling calls out to arbitrary URLs and the private-network guard misses link-local addressesBasecamp · Server-Side Request Forgery · 2025 · Medium–62votes
• #981824ValidDNS Setup allows sending mail on behalf of other customersBasecamp · Misconfiguration and Insecure Design · 2021–58votes
• #403602ValidAttachments may be hijacked via AppCache+CookieBombing trick (bc3_production_blobs bucket)Basecamp · Input Validation and Logic · 2020–57votes
• #1021885ValidBypass of image rewriting / tracking blocker via srcsetBasecamp · Information Disclosure · 2020$1,00056votes
• #3962925ValidLaunchpad file read leaks production keysBasecamp · File and Path Handling · 2026 · Critical$9,33755votes
• #3543475ValidImproper Access Control in `fizzy.do` import flow allows cross-tenant ActionText reference resolution and data disclosureBasecamp · Access Control · 2026 · Low–53votes
• #2686225ValidCritical Data Breach - Big Data for all domainsBasecamp · No weakness recorded · 2025 · Medium–53votes
• #963774ValidPremium Email Address Check Bypass - HeyBasecamp · Input Validation and Logic · 2020–53votes
• #3955956Validlaunchpad.37signals.com OAuth AS issues victim-bound credential to unverified attacker redirect → full CIA triad on Basecamp APIBasecamp · Authentication · 2026 · High–49votes
• #3943339ValidOne-click cross-account JavaScript execution steals a victim write token through Turbo pagination and unattached Active Storage HTMLBasecamp · Cross-site Scripting · 2026 · High–49votes
• #1288898ValidPassword reset link not expiring after changing password in settingsBasecamp · Authentication · 2021$25049votes
• #1253926ValidDomain Takeover [3737signals.com]Basecamp · Input Validation and Logic · 2021–48votes
• #1016966ValidRemote Code Execution in Basecamp Windows Electron AppBasecamp · Command and Code Injection · 2020–48votes
• #1245051ValidError Page Content Spoofing or Text InjectionBasecamp · Misconfiguration and Insecure Design · 2021$10045votes
• #4035023ValidOrdinary HEY user can make HEY originate authenticated mail from attacker-selected @hey.com addressesBasecamp · Access Control · 2026 · High–44votes
• #850022ValidCSRF on launchpad.37signals.com OAuth2 authorization endpointBasecamp · Cross-Site Request Forgery · 2020–44votes
• #1026196ValidInformation Disclosure of Garbage Collection Cycle 'Again'Basecamp · Information Disclosure · 2020$10041votes
• #1710541ValidArbitrary write in the application's data folder and arbitrary read of server's replies from 3rd party apps.Basecamp · File and Path Handling · 2023–38votes
• #3979217ValidCross-account webhook takeover: PUT and DELETE on /<account>/webhooks/<id>.json reach another account's webhookBasecamp · Authentication · 2026 · High–34votes
• #3999856ValidA third-party Basecamp OAuth token mints a full launchpad web session through GET /my/login_optionBasecamp · Access Control · 2026 · High–33votes
• #3972760ValidOpen redirect on app.hey.com bypasses HEY desktop's internal-origin allowlist and loads attacker content inside a HEY BrowserWindowBasecamp · Open Redirect · 2026 · Medium–33votes
• #981796ValidInformation Disclosure of Garbage Collection CycleBasecamp · Information Disclosure · 2020–33votes
• #2552879ValidNavgraph confusion allows any 3p app to send and read requests from the server at app.hey.comBasecamp · Deserialization and Object Injection · 2024 · Medium–31votes
• #1456063ValidRCE via exposed JMX server on jabber.37signals.com/jabber.basecamp.comBasecamp · Deserialization and Object Injection · 2022$10030votes
• #1019389ValidLack of quarantine macOS attribute(com.apple.quarantine) leads multiple issues including RCEBasecamp · No weakness recorded · 2021$25029votes
• #919175ValidHTTP request smuggling on Basecamp 2 allows web cache poisoningBasecamp · Injection and Smuggling · 2020–28votes
• #3981292ValidCross-account XSS on app.basecamp.com: oEmbed option injection chained through Turbo defeats the CSP nonceBasecamp · Cross-site Scripting · 2026 · High–27votes

The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.