Skip to content
bugbounty.fyi
Get paid to secure open source 475 paid open-source programs on Sorona, up to $1M Perk Low bugs: $100 or 1 mo Claude Max

Also on Patchstack. All 476 paid open-source programs

Try

Highest paying Newly launched Paid without KYC Full safe harbor
All results

About this site

Robinhood Markets

By Robinhood Markets, Inc. Vulnerability disclosure program on HackerOne robinhood.com

Accepting reports Full safe harbor
Go to program Website
Top reward
No cash rewards
Top severity paid
Critical
Assets in scope
29
Public CVEs
0
Last change

At a glance

What to know before you start testing.

No cash rewards
A disclosure program: you report for credit, not money.
Report on HackerOne
Submit through the program page.
Full safe harbor
Good-faith research is authorised; no legal action.
No public write-ups
Keep findings private.

Rewards

What HackerOne lists as the payout for each severity.

This program does not pay cash rewards.

Pays cash
Yes Researchers who use these headers and document them in their report will be given a $50 USD bonus on reports which receive a bounty award.
Safe harbor
Full Safe harbor for researchers is applied.

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Scope

29 assets you may test, 42 excluded.

Web 11

  • api.robinhood.com Critical No bounty
  • cashier.robinhood.com Critical No bounty
  • fusion.tradepmr.com Critical No bounty
  • identi.robinhood.com Critical No bounty
  • insight2.tradepmr.com Critical No bounty
  • minerva.robinhood.com Critical No bounty
  • nummus.robinhood.com Critical No bounty
  • oak.robinhood.net Critical No bounty
  • tradepmr.com Critical No bounty
  • www.bitstamp.net Critical No bounty
  • www.tradepmr.com Critical No bounty

Wildcard domains 9

  • *.1integrations.com Critical No bounty
  • *.rhapollo.net Critical No bounty
  • *.rhinternal.net Critical No bounty
  • *.robinhood.com Critical No bounty
  • *.robinhood.net Critical No bounty
  • *.say.rocks Medium No bounty
  • *.saytechnologies.com Medium No bounty
  • *.x1.co Critical No bounty
  • *.x1creditcard.com Critical No bounty

Android apps 5

  • com.robinhood.android Critical No bounty
  • com.robinhood.gateway Critical No bounty
  • com.robinhood.global Android Critical No bounty
  • com.robinhood.money Critical No bounty
  • net.bitstamp.app Critical No bounty

iOS apps 4

  • 1634080733 Critical No bounty
  • 6462308655 Critical No bounty
  • 938003185 Critical No bounty
  • Id1406825640 Critical No bounty
Out of scope (42)
  • _16928ca3f53f40a48a751be40fa24e4c.bitstamp.net
  • 7671800.bitstamp.net
  • 7671800.team.bitstamp.net
  • affiliates.robinhood.com
  • api-sandbox.tradepmr.com
  • api.tradepmr.com
  • api-validation.tradepmr.com
  • auth-sandbox.tradepmr.com
  • auth.tradepmr.com
  • auth-validation.tradepmr.com
  • autodiscover.bitstamp.net
  • bounces.bitstamp.net
  • careers.robinhood.com
  • content.research.robinhood.com
  • _domainconnect.bitstamp.net
  • earlytalent.robinhood.com
  • em1198.bitstamp.net
  • em4296.team.bitstamp.net
  • em9457.team.bitstamp.net
  • enterpriseenrollment.bitstamp.net
  • enterpriseregistration.bitstamp.net
  • esg.robinhood.com
  • events.robinhood.com
  • fleet.infra.robinhood.net
  • fusion-demo.tradepmr.com
  • fusion-demo.uat2.tradepmr.com
  • fusion-demo.uat.tradepmr.com
  • fusion.uat2.tradepmr.com
  • fusion.uat3.tradepmr.com
  • fusion.uat.tradepmr.com
  • go.robinhood.com
  • https://www.saytechnologies.com/contact/sales
  • press.robinhood.com
  • roadshow.robinhood.com
  • share.robinhood.com
  • shop.robinhood.com
  • startinvesting.robinhood.com
  • status.bitstamp.net
  • underthehoodpod.robinhood.com
  • url6884.team.bitstamp.net
  • vgs-api.robinhood.com
  • weareallinvestors.robinhood.com

Rules

What the policy asks of you, and the bug types it won't reward, quoted from Robinhood Markets (via HackerOne)'s policy. "We" in these lines means the program, not this site.

While testing

  • Only interact with and test bugs against accounts you own.
  • Do not save, download, export, store, copy, move, or otherwise retain any sensitive or personally identifiable information
  • Do not exceed $1,000 USD when testing unbounded loss vulnerabilities.
  • Do not disclose reports made to the Robinhood vulnerability disclosure program at any time, in any location independent of the HackerOne platform.
  • Do not perform resource intensive tests which could result in disruption or downtime for our services.
  • Do not make financial transactions with other user accounts you do not own.
  • Do not send large volumes of data to our websockets.
  • Do not create large volumes of support tickets.

Not accepted

  • Findings dependent on account takeover (ATO) are typically not accepted

Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original

Changes

Tracked since 11 Nov 2026. Last checked 1 hour ago.

No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.

Before we tracked it

Scope and reward changes recorded before this page started tracking it.

  1. Scope added

    com.robinhood.global Android

  2. Scope added

    em4296.team.bitstamp.net (out of scope)

  3. Scope added

    em9457.team.bitstamp.net (out of scope)

  4. Scope added

    enterpriseenrollment.bitstamp.net (out of scope)

  5. Scope added

    enterpriseregistration.bitstamp.net (out of scope)

  6. Scope added

    status.bitstamp.net (out of scope)

  7. Scope added

    url6884.team.bitstamp.net (out of scope)

  8. Scope added

    Id1406825640

  9. Scope added

    net.bitstamp.app

  10. Scope added

    7671800.bitstamp.net (out of scope)

  11. Scope added

    7671800.team.bitstamp.net (out of scope)

  12. Scope added

    _16928ca3f53f40a48a751be40fa24e4c.bitstamp.net (out of scope)

  13. Scope added

    _domainconnect.bitstamp.net (out of scope)

  14. Scope added

    autodiscover.bitstamp.net (out of scope)

  15. Scope added

    bounces.bitstamp.net (out of scope)

  16. Scope added

    em1198.bitstamp.net (out of scope)

  17. Scope added

    www.bitstamp.net

  18. Scope added

    affiliates.robinhood.com (out of scope)

  19. Scope added

    api-sandbox.tradepmr.com (out of scope)

  20. Scope added

    api-validation.tradepmr.com (out of scope)

  21. Scope added

    api.tradepmr.com (out of scope)

  22. Scope added

    auth-sandbox.tradepmr.com (out of scope)

  23. Scope added

    auth-validation.tradepmr.com (out of scope)

  24. Scope added

    auth.tradepmr.com (out of scope)

  25. Scope added

    careers.robinhood.com (out of scope)

  26. Scope added

    content.research.robinhood.com (out of scope)

  27. Scope added

    earlytalent.robinhood.com (out of scope)

  28. Scope added

    esg.robinhood.com (out of scope)

  29. Scope added

    events.robinhood.com (out of scope)

  30. Scope added

    fleet.infra.robinhood.net (out of scope)

  31. Scope added

    fusion-demo.tradepmr.com (out of scope)

  32. Scope added

    fusion-demo.uat.tradepmr.com (out of scope)

  33. Scope added

    fusion-demo.uat2.tradepmr.com (out of scope)

  34. Scope added

    fusion.uat.tradepmr.com (out of scope)

  35. Scope added

    fusion.uat2.tradepmr.com (out of scope)

  36. Scope added

    fusion.uat3.tradepmr.com (out of scope)

  37. Scope added

    go.robinhood.com (out of scope)

  38. Scope added

    https://www.saytechnologies.com/contact/sales (out of scope)

  39. Scope added

    press.robinhood.com (out of scope)

  40. Scope added

    roadshow.robinhood.com (out of scope)

Public CVEs

Published vulnerabilities in this vendor's products, from the NVD.

Search NVD

No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.

Original policy

Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.

Welcome to the Robinhood Vulnerability Disclosure Program! We’re excited to work more closely with you on discovering bugs in Robinhood. Thank you for helping keep Robinhood and our users safe! Robinhood Markets, Inc.

Overview: VDP Rules

By submitting reports to our program, you agree that you’ve read, understood, and will follow our Program Rules and overall Program Policy.

  • Be careful with sensitive information. If sensitive information, such as personally identifiable information or user account credentials, is uncovered as part of your research, stop and report it to us immediately. Do not save, download, export, store, copy, move, or otherwise retain any sensitive or personally identifiable information, and work with us on any additional requests we may have.
  • Test responsibly. Only interact with and test bugs against accounts you own. We do not allow testing against user accounts not owned by the Security Researcher. Reach out to us if you need help with testing cross-account issues.
  • Do not cause harm. Do not engage in activities that disrupt, damage, or otherwise cause harm to or defraud Robinhood, our users, our employees, our data or our users’ data, or our brand—including, without limitation, denial of service attacks, social engineering, phishing, spam, social media scams, fraudulent transactions, data exfiltration or tampering, or physical attacks.
  • Do not exceed $1,000 USD when testing unbounded loss vulnerabilities. When you reach $1,000 USD file your report with all verification you have completed so far. Internal teams will verify unbounded loss vulnerabilities collaboratively with you. Testing over $1,000 USD may result in termination from our program.
  • Do not disclose reports made to the Robinhood vulnerability disclosure program at any time, in any location independent of the HackerOne platform.

Violation of any of our Program Rules may result in (but is not limited to) consequences such as permanent disqualification and removal from the Robinhood Vulnerability Disclosure Program, or voiding the protections of the HackerOne Gold Standard Safe Harbor.

Overview: Special Considerations

Due to the nature of our business, we ask that you also follow these guidelines:

  • Do not perform resource intensive tests which could result in disruption or downtime for our services.
  • Do not make financial transactions with other user accounts you do not own.
  • Findings dependent on account takeover (ATO) are typically not accepted
  • If your report shows theoretical impact rather than demonstrates an impact (e.g. ‘This flaw could result in information disclosure’ versus ‘Here is the information I was able to access using the flaw’), severities will be lower. Safe harbor for researchers is applied.
  • Do not send large volumes of data to our websockets.
  • Do not create large volumes of support tickets.

#Overview: Submission Requirements # Use the following headers when making requests to Robinhood resources or assets for vulnerability disclosure research where is your HackerOne username and is the email associated with the test account you’re making the request with: X-Bug-Bounty: <Username> X-Test-Account-Email: <TestAccountEmail> Researchers who use these headers and document them in their report will be given a $50 USD bonus on reports which receive a bounty award.