Your BasecampHQ account is easy to compromise.

I know 37 Signals doesn't read this forum because it's too hard, waaaanh. They already know about this CSRF/XSRF attack, and say it's not a problem even though it's super easy for your entire account to be compromised. The thing is, fixing it won't change anything about how basecamp works but it will resolve the issue.

Pay 37signals at your own peril.