Does Basecamp have a bug bounty program?

Yes, Basecamp runs a public bug bounty program on HackerOne. It currently lists 17 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/HackerOne/basecamp

Basecamp

HackerOne·updated 11h ago

bountyswagopen

Discord → RSS

payout: no bounty
scope: 17 in · 3 out
safe harbor: unknown
response: no reports

open program

hunt score

cashfresh

formula →

payout

0/55

bounty

20/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

17 in-scope

7other
4urls
3source
2ios
1wildcards

Scope

In scope

017

wildcards01

+*.hey.comscope· critical

urls04

+app.basecamp.com· critical
+app.fizzy.do· critical
+launchpad.37signals.com· critical
+world.hey.com· critical

ios02

+com.basecamp.bc3-ios· critical
+com.hey.app.ios· critical

source code03

+github.com/basecamp/once-campfire· high
+github.com/basecamp/trix· critical
+github.com/basecamp/writebook· high

other07

+Basecamp.app· critical
+HEY.app· critical
+HEY.exe· critical
+basecamp-setup.exe· critical
+com.basecamp.bc3· critical
+com.basecamp.hey· critical
+hey-mail· critical

Out of scope

003

wildcards02

−*.basecamphq.com
−*.highrisehq.com

urls01

−basecamp.com

Change history

3 events

in-scope over 32dpeak 17

first indexedscope addedscope removedreward change

2026-09-07
+ added 1 scope · app.fizzy.do
− removed 1 scope · fizzy.do
60d ago
2026-09-06
+ added 1 scope · https://github.com/basecamp/trix
61d ago
2026-08-06
first indexed
92d ago · 16 in-scope assets

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Basecamp.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": 0,
  "url": "https://hackerone.com/basecamp",
  "name": "Basecamp",
  "handle": "basecamp",
  "targets": {
    "in_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "*.hey.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "Basecamp for Mac: https://basecamp.com/via#basecamp-for-your-mac-or-pc",
        "max_severity": "critical",
        "asset_identifier": "Basecamp.app",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "HEY for macOS: https://hey.com/apps/",
        "max_severity": "critical",
        "asset_identifier": "HEY.app",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WINDOWS_APP_STORE_APP_ID",
        "instruction": "HEY for Windows: https://www.microsoft.com/en-us/p/hey-mail/9pf08ljw7gw2",
        "max_severity": "critical",
        "asset_identifier": "HEY.exe",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Basecamp 5",
        "max_severity": "critical",
        "asset_identifier": "app.basecamp.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Full source code is available at https://github.com/basecamp/fizzy and https://github.com/basecamp/fizzy-saas",
        "max_severity": "critical",
        "asset_identifier": "app.fizzy.do",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "Basecamp for Windows: https://basecamp.com/via#basecamp-for-your-mac-or-pc",
        "max_severity": "critical",
        "asset_identifier": "basecamp-setup.exe",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "Basecamp for Android: https://basecamp.com/via#basecamp-for-ios-and-android-devices",
        "max_severity": "critical",
        "asset_identifier": "com.basecamp.bc3",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "Basecamp for iOS: https://basecamp.com/via#basecamp-for-ios-and-android-devices",
        "max_severity": "critical",
        "asset_identifier": "com.basecamp.bc3-ios",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "GOOGLE_PLAY_APP_ID",
        "instruction": "HEY for Android: https://play.google.com/store/apps/details?id=com.basecamp.hey",
        "max_severity": "critical",
        "asset_identifier": "com.basecamp.hey",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "APPLE_STORE_APP_ID",
        "instruction": "HEY for iOS: https://apps.apple.com/us/app/hey-email/id1506603805",
        "max_severity": "critical",
        "asset_identifier": "com.hey.app.ios",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "DOWNLOADABLE_EXECUTABLES",
        "instruction": "HEY for Linux: https://snapcraft.io/hey-mail/",
        "max_severity": "critical",
        "asset_identifier": "hey-mail",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "[Campfire](https://once.com/campfire) is an installable, self-hosted group chat system designed, built, and backed by 37signals.\n\nhttps://once.com/campfire",
        "max_severity": "high",
        "asset_identifier": "https://github.com/basecamp/once-campfire",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "[Trix](https://trix-editor.org/) is a rich text editor used in HEY. \n\nFindings in Trix that are reproducible in HEY are eligible for bounties, but other issues that are mitigated in HEY and only reproducible in standalone Trix or in a different app setting are not eligible for bounty. ",
        "max_severity": "critical",
        "asset_identifier": "https://github.com/basecamp/trix",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "SOURCE_CODE",
        "instruction": "[Writebook](https://once.com/writebook) is an installable, self-hosted app to publish your own books on the web. \n\nhttps://once.com/writebook",
        "max_severity": "high",
        "asset_identifier": "https://github.com/basecamp/writebook",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "Launchpad",
        "max_severity": "critical",
        "asset_identifier": "launchpad.37signals.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "URL",
        "instruction": "",
        "max_severity": "critical",
        "asset_identifier": "world.hey.com",
        "eligible_for_bounty": true,
        "integrity_requirement": null,
        "eligible_for_submission": true,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ],
    "out_of_scope": [
      {
        "asset_type": "WILDCARD",
        "instruction": "Basecamp Classic",
        "max_severity": "none",
        "asset_identifier": "*.basecamphq.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      },
      {
        "asset_type": "WILDCARD",
        "instruction": "Highrise",
        "max_severity": "none",
        "asset_identifier": "*.highrisehq.com",
        "eligible_for_bounty": false,
        "integrity_requirement": "high",
        "eligible_for_submission": false,
        "availability_requirement": "high",
        "confidentiality_requirement": "high"
      },
      {
        "asset_type": "URL",
        "instruction": "Basecamp 2",
        "max_severity": "none",
        "asset_identifier": "basecamp.com",
        "eligible_for_bounty": false,
        "integrity_requirement": null,
        "eligible_for_submission": false,
        "availability_requirement": null,
        "confidentiality_requirement": null
      }
    ]
  },
  "website": "https://37signals.com/policies/security/response",
  "offers_swag": true,
  "managed_program": false,
  "offers_bounties": true,
  "submission_state": "open",
  "allows_bounty_splitting": true,
  "average_time_to_bounty_awarded": 188,
  "response_efficiency_percentage": 97,
  "average_time_to_report_resolved": 11225,
  "average_time_to_first_program_response": 13
}