From e86960dc9f5f88d25641106f31287e935c475f12 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 8 Aug 2026 15:24:38 -0700 Subject: [PATCH 1/2] Add an org-wide default security policy --- SECURITY.md | 25 +++++++++++++++++++++++++ 1 file changed, 25 insertions(+) create mode 100644 SECURITY.md diff --git a/SECURITY.md b/SECURITY.md new file mode 100644 index 0000000..91499c9 --- /dev/null +++ b/SECURITY.md @@ -0,0 +1,25 @@ +# Security Policy + +37signals takes security seriously and appreciates responsible disclosure. Our full policy, +including response commitments, is at +[37signals.com/policies/security/response](https://37signals.com/policies/security/response/). + +**Do not open a public issue for security bugs.** + +## Reporting a vulnerability + +Report vulnerabilities through our public bug bounty program on HackerOne: +[**hackerone.com/basecamp**](https://hackerone.com/basecamp). It covers our products and the +open-source software we publish, and reports are eligible for bounties. + +For a vulnerability in one of our open-source repositories, you may instead report privately via +GitHub: the affected repository's **Security** tab → **Report a vulnerability**. + +Some repositories carry their own `SECURITY.md` with more specific instructions; when present, it +takes precedence over this default. + +## What to expect + +We typically respond to HackerOne reports within 72 hours. We'll acknowledge your report, +investigate, and coordinate a fix. Issues stay undisclosed until fully investigated and patched; +after that, we credit reporters in the disclosure unless they prefer otherwise. From 93781712bb71f0e868eed94168c24b62a78a64c6 Mon Sep 17 00:00:00 2001 From: Jeremy Daer Date: Sat, 8 Aug 2026 16:02:14 -0700 Subject: [PATCH 2/2] Scope HackerOne to in-scope assets; OSS and ONCE report via GHSA --- SECURITY.md | 18 ++++++++++-------- 1 file changed, 10 insertions(+), 8 deletions(-) diff --git a/SECURITY.md b/SECURITY.md index 91499c9..558801b 100644 --- a/SECURITY.md +++ b/SECURITY.md @@ -8,18 +8,20 @@ including response commitments, is at ## Reporting a vulnerability -Report vulnerabilities through our public bug bounty program on HackerOne: -[**hackerone.com/basecamp**](https://hackerone.com/basecamp). It covers our products and the -open-source software we publish, and reports are eligible for bounties. +**Open-source libraries and ONCE apps** (most of what's on this GitHub org): report privately via +GitHub — the affected repository's **Security** tab → **Report a vulnerability**. These reports +aren't bounty-eligible, but we accept them via [HackerOne](https://hackerone.com/basecamp) too if +you'd like the report on your HackerOne record. -For a vulnerability in one of our open-source repositories, you may instead report privately via -GitHub: the affected repository's **Security** tab → **Report a vulnerability**. +**Our products** (Basecamp, HEY, and other assets in scope of our bug bounty program): report +through HackerOne at [**hackerone.com/basecamp**](https://hackerone.com/basecamp), where in-scope +reports are eligible for bounties. Some repositories carry their own `SECURITY.md` with more specific instructions; when present, it takes precedence over this default. ## What to expect -We typically respond to HackerOne reports within 72 hours. We'll acknowledge your report, -investigate, and coordinate a fix. Issues stay undisclosed until fully investigated and patched; -after that, we credit reporters in the disclosure unless they prefer otherwise. +We'll acknowledge your report, investigate, and coordinate a fix. Issues stay undisclosed until +fully investigated and patched; after that, we credit reporters in the disclosure unless they +prefer otherwise.