H1 HackerOne LIVE
Basecamp
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://37signals.com/policies/security/response
- managed triage
- no
- response efficiency
- 100%
- first response
- 13h avg
- time to bounty
- 236h avg
17 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
app.basecamp.com | domain | yes | critical | 2026-09-20 |
app.fizzy.do | domain | no | critical | 2026-09-20 |
launchpad.37signals.com | domain | yes | critical | 2026-09-20 |
world.hey.com | domain | yes | critical | 2026-09-20 |
Basecamp.app | executable | yes | critical | 2026-09-20 |
HEY.app | executable | yes | critical | 2026-09-20 |
HEY.exe | executable | yes | critical | 2026-09-20 |
basecamp-setup.exe | executable | yes | critical | 2026-09-20 |
hey-mail | executable | yes | critical | 2026-09-20 |
com.basecamp.bc3 | mobile | yes | critical | 2026-09-20 |
com.basecamp.bc3-ios | mobile | yes | critical | 2026-09-20 |
com.basecamp.hey | mobile | yes | critical | 2026-09-20 |
com.hey.app.ios | mobile | yes | critical | 2026-09-20 |
https://github.com/basecamp/once-campfire | source code | no | high | 2026-09-20 |
https://github.com/basecamp/trix | source code | no | critical | 2026-09-20 |
https://github.com/basecamp/writebook | source code | no | high | 2026-09-20 |
*.hey.com | wildcard | yes | critical | 2026-09-20 |
3 out of scope — black ICE, don't touch
basecamp.comdomain*.basecamphq.comwildcard*.highrisehq.comwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.