Basecamp · Report #3962925
Launchpad file read leaks production keys
Validstatus
criticalseverity
$9,337bounty
55upvotes
28 Oct 2026disclosed
Summary
A file-read vulnerability in Launchpad exposed production storage credentials. We fixed the vulnerable processing path, rotated the exposed credentials and deleted the old key. Thanks to bl0rph for a detailed report and for working with us through remediation.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.