Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Remote code execution on Basecamp.comAnalysed#365271 | Valid | Command and Code Injection | Critical | 2020-11-26 | $5,000 | 417 |
| HEY.com email stored XSSAnalysed#982291 | Valid | Cross-site Scripting | Critical | 2020-10-27 | $5,000 | 360 |
| a very long name in hey.com can prevent anyone from accessing their contacts and probably can cause denial of serviceAnalysed#1018037 | Valid | Denial of Service | High | 2020-11-10 | $1,000 | 132 |
| stored XSS in hey.com message contentAnalysed#988272 | Valid | Cross-site Scripting | Medium | 2020-10-31 | – | 80 |
| Possible DOM XSS on app.hey.comAnalysed#1010132 | Valid | Cross-site Scripting | High | 2020-10-27 | – | 68 |
| Attachments may be hijacked via AppCache+CookieBombing trick (bc3_production_blobs bucket)Analysed#403602 | Valid | Input Validation and Logic | High | 2020-11-26 | – | 57 |
| Bypass of image rewriting / tracking blocker via srcsetAnalysed#1021885 | Valid | Information Disclosure | Medium | 2020-12-03 | $1,000 | 56 |
| Premium Email Address Check Bypass - HeyAnalysed#963774 | Valid | Input Validation and Logic | Medium | 2020-12-15 | – | 53 |
| Remote Code Execution in Basecamp Windows Electron AppAnalysed#1016966 | Valid | Command and Code Injection | High | 2020-11-19 | – | 48 |
| CSRF on launchpad.37signals.com OAuth2 authorization endpointAnalysed#850022 | Valid | Cross-Site Request Forgery | High | 2020-10-30 | – | 44 |
| Information Disclosure of Garbage Collection Cycle 'Again'Analysed#1026196 | Valid | Information Disclosure | Low | 2020-12-16 | $100 | 41 |
| Information Disclosure of Garbage Collection CycleAnalysed#981796 | Valid | Information Disclosure | Low | 2020-11-04 | – | 33 |
| HTTP request smuggling on Basecamp 2 allows web cache poisoningAnalysed#919175 | Valid | Injection and Smuggling | Critical | 2020-10-28 | – | 28 |
| Unauthenticated request smuggling on launchpad.37signals.comAnalysed#867577 | Valid | Injection and Smuggling | Critical | 2020-10-28 | – | 27 |
| Bypass Tracking Blocker Protection Using Slashes Without Protocol On The Image Source.Analysed#1050656 | Valid | No weakness recorded | Medium | 2020-12-17 | – | 17 |
| SSL expired subdomain leads to API swap with main and flagged cookies. Unable to log device ids and certain session tokens.Analysed#1024880 | Valid | Authentication | Medium | 2020-12-03 | – | 15 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.