Robinhood Markets Bounty
By Robinhood Bug bounty on HackerOne robinhood.com
- Top reward
- $25,000
- Top severity paid
- Critical
- Assets in scope
- 24
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- Pays up to $25,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$25,000 from $3,000 |
| High |
|
$10,000 from $1,000 |
| Medium |
|
$5,000 from $500 |
| Low |
|
$500 from $100 |
- Safe harbor
-
Full
Safe harbor for researchers is applied.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
24 assets you may test, 43 excluded.
Web 9
- api.robinhood.com Critical
- cashier.robinhood.com Critical
- fusion.tradepmr.com Critical No bounty
- identi.robinhood.com Critical
- insight2.tradepmr.com Critical No bounty
- minerva.robinhood.com Critical
- nummus.robinhood.com Critical
- www.bitstamp.net Critical
- www.tradepmr.com Critical No bounty
Android apps 5
- com.robinhood.android Critical
- com.robinhood.gateway Critical
- com.robinhood.global Android Critical
- com.robinhood.money Critical
- net.bitstamp.app Critical
Wildcard domains 5
- *.rhinternal.net Critical
- *.robinhood.com Critical
- *.robinhood.net Critical
- *.say.rocks Medium
- *.saytechnologies.com Medium
iOS apps 4
- 1634080733 Critical
- 6462308655 Critical
- 938003185 Critical
- Id1406825640 Critical
Products and areas 1
- Tier 3 Critical
Out of scope (43)
- _16928ca3f53f40a48a751be40fa24e4c.bitstamp.net
- 7671800.bitstamp.net
- 7671800.team.bitstamp.net
- affiliates.robinhood.com
- api-sandbox.tradepmr.com
- api.tradepmr.com
- api-validation.tradepmr.com
- auth-sandbox.tradepmr.com
- auth.tradepmr.com
- auth-validation.tradepmr.com
- autodiscover.bitstamp.net
- bounces.bitstamp.net
- careers.robinhood.com
- content.research.robinhood.com
- _domainconnect.bitstamp.net
- earlytalent.robinhood.com
- em1198.bitstamp.net
- em4296.team.bitstamp.net
- em9457.team.bitstamp.net
- enterpriseenrollment.bitstamp.net
- enterpriseregistration.bitstamp.net
- esg.robinhood.com
- events.robinhood.com
- fleet.infra.robinhood.net
- fusion-demo.tradepmr.com
- fusion-demo.uat2.tradepmr.com
- fusion-demo.uat.tradepmr.com
- fusion.uat2.tradepmr.com
- fusion.uat3.tradepmr.com
- fusion.uat.tradepmr.com
- go.robinhood.com
- https://www.saytechnologies.com/contact/sales
- press.robinhood.com
- roadshow.robinhood.com
- sandbox.bitstamp.net
- share.robinhood.com
- shop.robinhood.com
- startinvesting.robinhood.com
- status.bitstamp.net
- underthehoodpod.robinhood.com
- url6884.team.bitstamp.net
- vgs-api.robinhood.com
- weareallinvestors.robinhood.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Robinhood Markets Bounty (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Only interact with and test bugs against accounts you own.
-
Do not save, store, copy, move, or otherwise retain sensitive information
-
Do not engage in activities that disrupt, damage, or otherwise cause harm to or defraud Robinhood
-
Do not exceed $1,000 USD when testing unbounded loss vulnerabilities.
-
Do not disclose reports made to the Robinhood bug bounty program at any time, in any location independent of the HackerOne platform.
-
Do not perform resource intensive tests which could result in disruption or downtime for our services.
-
Do not make financial transactions with other user accounts you do not own.
-
Do not send large volumes of data to our websockets.
-
Do not create large volumes of support tickets.
Not accepted
-
SPF issues
-
Physical attacks against Robinhood employees, offices, or data centers
-
Social engineering attacks against Robinhood employees or users, including phishing
-
Vulnerabilities in third-party integrations with the Robinhood API or third-party banking functionality
-
Vulnerabilities that require physical access, rooted / jailbroken devices, or debug access to a user’s device
-
Denial of service without prior authorization
-
Subdomain takeover without taking over the subdomain
-
Cache poisoning
-
Email list or notification setting configuration issues or information disclosure
-
Clickjacking without impact
-
Disclosure of publicly available information
-
Lack of security flags in cookies (except session cookies)
-
Lack of security headers unless exploitable
-
Vulnerabilities caused by out-of-date browsers or browser add-ons
-
Vulnerabilities caused by out-of-date or no longer maintained Android or iOS versions
-
Mobile application root and jailbreak detection
-
For Say Technologies: Voting information disclosure via IDOR, and anything including contact or support forms
-
DNS records including email policy (SPF, DKIM, DMARC), DNSSEC
-
Issues related to unsafe SSL/TLS cipher suites or protocol versions unless exploitable
-
Lack of EXIF stripping on uploads, unless those uploads are publicly accessible
-
Logout CSRF
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
com.robinhood.global Android
-
Scope added
Tier 3
-
Scope added
em4296.team.bitstamp.net (out of scope)
-
Scope added
em9457.team.bitstamp.net (out of scope)
-
Scope added
enterpriseenrollment.bitstamp.net (out of scope)
-
Scope added
enterpriseregistration.bitstamp.net (out of scope)
-
Scope added
sandbox.bitstamp.net (out of scope)
-
Scope added
status.bitstamp.net (out of scope)
-
Scope added
url6884.team.bitstamp.net (out of scope)
-
Scope added
Id1406825640
-
Scope added
net.bitstamp.app
-
Scope added
7671800.bitstamp.net (out of scope)
-
Scope added
7671800.team.bitstamp.net (out of scope)
-
Scope added
_16928ca3f53f40a48a751be40fa24e4c.bitstamp.net (out of scope)
-
Scope added
_domainconnect.bitstamp.net (out of scope)
-
Scope added
autodiscover.bitstamp.net (out of scope)
-
Scope added
bounces.bitstamp.net (out of scope)
-
Scope added
em1198.bitstamp.net (out of scope)
-
Scope added
www.bitstamp.net
-
Scope added
affiliates.robinhood.com (out of scope)
-
Scope added
api-sandbox.tradepmr.com (out of scope)
-
Scope added
api-validation.tradepmr.com (out of scope)
-
Scope added
api.tradepmr.com (out of scope)
-
Scope added
auth-sandbox.tradepmr.com (out of scope)
-
Scope added
auth-validation.tradepmr.com (out of scope)
-
Scope added
auth.tradepmr.com (out of scope)
-
Scope added
careers.robinhood.com (out of scope)
-
Scope added
content.research.robinhood.com (out of scope)
-
Scope added
earlytalent.robinhood.com (out of scope)
-
Scope added
esg.robinhood.com (out of scope)
-
Scope added
events.robinhood.com (out of scope)
-
Scope added
fleet.infra.robinhood.net (out of scope)
-
Scope added
fusion-demo.tradepmr.com (out of scope)
-
Scope added
fusion-demo.uat.tradepmr.com (out of scope)
-
Scope added
fusion-demo.uat2.tradepmr.com (out of scope)
-
Scope added
fusion.uat.tradepmr.com (out of scope)
-
Scope added
fusion.uat2.tradepmr.com (out of scope)
-
Scope added
fusion.uat3.tradepmr.com (out of scope)
-
Scope added
go.robinhood.com (out of scope)
-
Scope added
https://www.saytechnologies.com/contact/sales (out of scope)
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Robinhood Markets Bounty looks forward to working with the security community to find vulnerabilities in order to keep our businesses and customers safe.
Bug Bounty Program Rules
By submitting reports to our program, you agree that you’ve read, understood, and will follow our Program Rules and overall Program Policy.
- Be careful with sensitive information. If sensitive information such as personal information or user credentials are uncovered as part of your research, stop and report it to us immediately. Do not save, store, copy, move, or otherwise retain sensitive information, and work with us on any additional requests we may have.
- Test responsibly. Only interact with and test bugs against accounts you own. We do not allow testing against user accounts not owned by the Security Researcher. Reach out to us if you need help with testing cross-account issues.
- Do not cause harm. Do not engage in activities that disrupt, damage, or otherwise cause harm to or defraud Robinhood, our users, our employees, our data or our users’ data, or our brand—including, without limitation, denial of service attacks, social engineering, phishing, spam, social media scams, fraudulent transactions, data exfiltration or tampering, or physical attacks.
- Do not exceed $1,000 USD when testing unbounded loss vulnerabilities. When you reach $1,000 USD file your report with all verification you have completed so far. Internal teams will verify unbounded loss vulnerabilities collaboratively with you. Testing over $1,000 USD may result in termination from our program.
- Do not disclose reports made to the Robinhood bug bounty program at any time, in any location independent of the HackerOne platform.
Violation of any of our Program Rules may result in (but is not limited to) consequences such as ineligibility for a bounty, permanent disqualification and removal from the Robinhood Bug Bounty Program, or voiding the protections of the HackerOne
Special Considerations
Due to the nature of our business, we ask that you also follow these guidelines:
- Do not perform resource intensive tests which could result in disruption or downtime for our services.
- Do not make financial transactions with other user accounts you do not own.
- Findings dependent on account takeover (ATO) are typically not accepted, though we may award a small bonus for bugs we consider novel.
- Do not send large volumes of data to our websockets.
- Do not create large volumes of support tickets.
The most common reason reports are rejected as ‘informative’ rather than for a bounty is because of impact. If your report shows theoretical impact rather than demonstrates an impact (e.g. ‘This flaw could result in information disclosure’ versus ‘Here is the information I was able to access using the flaw’), severities (and bounties) will be lower.
Safe harbor for researchers is applied.
Eligibility to Participate
To be eligible to participate in any Robinhood Bug Bounty Program, you must:
- Be at least 18 years of age and meet Robinhood account requirements if you test using a Robinhood account
- Not be employed by Robinhood as an employee, contingent worker, or contractor (including individuals who separated from Robinhood within the prior 12 months) or be an immediate family member of a current or former Robinhood employee, contingent worker, or contractor
- Not be a resident of or an individual located within a country appearing on any U.S. sanctions lists, as administered by the Office of Foreign Assets Control (OFAC)
- Not be in violation of any national, state, or local law or regulation with respect to any activities directly or indirectly related to the Bug Bounty Program
Robinhood also maintains a VIP Bug Bounty Program, which allows access to pre-release features in advance of their launch before the general public. Researchers who participate in our program may be invited to join the VIP Program based on the quality and consistency of their reports, with at least 3-5 reports submitted over time.
Submission Requirements
Use the following headers when making requests to Robinhood resources or assets for bug bounty where is your HackerOne username and is the email associated with the test account you’re making the request with:
X-Bug-Bounty: <Username>
X-Test-Account-Email: <TestAccountEmail>
Please include these host values in your report, as well as your breakdown of the CVSS score you assign to your submission.
Rewards
Our rewards are based on severity per CVSS (the Common Vulnerability Scoring Standard). We’ll work with you to find an accurate CVSS score for your report, but please note these are general guidelines and reward decisions are up to the discretion of Robinhood.
Our program calculates bounties for reports based on a sliding CVSSv3 scale; the higher the issue’s score, the higher your bounty will be. We’ll use lower environmental scores for assets that are less important to Robinhood. We encourage rating your issues with CVSS before submission and including a breakdown of what your understanding of the criteria to be, but know that we may have to make adjustments in the event the score isn’t representative of the true impact. True impact will be determined by a host of factors including whether mitigations are in place, whether token interception/account takeover (ATO) is a requirement of the attack, the type of sensitive information disclosed, and what can actually be done with the identified exploit. The most common reason reports are rejected as ‘informative’ rather than for a bounty is because of a failure to provide demonstrable impact. If your report shows theoretical impact rather than demonstrates impact (e.g. ‘This flaw could result in information disclosure’ versus ‘Here is the information I was able to access using the flaw’), severities will be lower. It’s worth noting that severity gets decreased when: exploitation is currently mitigated by effective compensating controls; the vulnerability is only exploitable internally such as behind authentication systems (e.g., Okta) or requires specific privileges that limit accessibility; or the exploitation scenario involves user interactions or conditions that are unlikely to be met or are heavily constrained. Additionally no bounties will be awarded for issues which are fixed and no longer reproducible if the issue is fixed prior to the ticket being triaged/not as a result of the bug bounty ticket. Final determination of the eligibility and severity of the issue will be made by and at the sole discretion of the Robinhood Security Team.
Eligibility is limited to domains and properties owned and operated by Robinhood and its acquisitions. Software components used within Robinhood are eligible and may be exploited in your vulnerability testing. Note that bugs in third-party components only qualify if we determine that they can be used to successfully exploit Robinhood. Root cause duplicates (i.e. same issue across multiple hosts or endpoints) will be considered duplicates when the underlying component/mechanism is the same. Bounties will not be paid for fixed issues which are no longer reproducible, if issues are already known before the ticket is validated, or if they were fixed not as a result of the bug bounty submission.
Zero-Day Issues
Robinhood accepts zero-day issues in third party software that can be directly used to compromise the confidentiality or integrity of our products. Zero-day issues may be submitted to our program at any time; however, we will only accept reports that permit us to disclose the issue to the relevant vendors. We cannot authorize testing against any third parties or our vendors.
Starting Point
Not sure where to start? Here are a few areas we’d like to see more coverage of and some questions to get you started:
- Authenticated issues - Create a test account using your HackerOne email and test functionality from the perspective of an authenticated user. What bugs exist in authenticated workflows?
- Business Logic issues - Can UI protections be circumvented with underlying API calls or can you perform sequence steps out of order in ways that have a security impact?
- Sensitive Information Disclosure - Are there places in the application where sensitive data like SSNs or other PII are handled insecurely?
Configuration files are provided solely to assist you in configuring your tooling. Robinhood makes no representations or warranties, express or implied, and assumes no responsibility or liability for any outcomes or issues arising from its use.
Scope
Tier 1:
- *.rhapollo.net - Rhapollo.net contains internal Robinhood services.
- *.rhinternal.net - Rhinternal.net contains internal Robinhood services.
- *.robinhood.com - Robinhood.com contains the bulk of Robinhood web assets, APIs, and publicly accessible services.
- api.robinhood.com - api.robinhood.com is an AWS ALB that proxies traffic to many different Robinhood services. For example, while Cashier is available at cashier.robinhood.com, it’s also available at api.robinhood.com/cashier. In most cases, the endpoints should be identical in functionality.
- nummus.robinhood.com - Nummus handles cryptocurrency trading for Robinhood users, and tracks cryptocurrency account balances.
- *.robinhood.net - Robinhood.net contains internal Robinhood services. You shouldn’t be able to log into anything here. oak.robinhood.net
- Major Oak (also accessible internally at oak.robinhood.com) is our internal administrative tooling, which is used by Customer Support to make changes to customer accounts. Access to and vulnerabilities in Major Oak are very sensitive.
- 1634080733 iOS - Robinhood Wallet is an application for owning and managing your blockchain assets in a self-custody crypto wallet.
- 6462308655 iOS - Robinhood Credit Card is an application for the Robinhood Gold Card.
- 938003185 iOS - Robinhood: Trading and Investing is an online brokerage application for trading and investing
- com.robinhood.android Android - Robinhood: Trading and Investing is an online brokerage application for trading and investing
- com.robinhood.gateway Android - Robinhood Wallet is an application for owning and managing your blockchain assets in a self-custody crypto wallet.
- com.robinhood.money Android - Robinhood Credit Card is an application for the Robinhood Gold Card.
- com.robinhood.global Android - Robinhood: Trading and Investing is an online brokerage application for trading and investing for international users
- www.bitstamp.net - www.bitstamp.net is the main host associated with the Bitstamp website. Subdomains are in Tier 3.
Tier 2:
- *.saytechnologies.com
- *.say.rocks
Tier 3:
- *.1integrations.com
- *.x1.co
- *.x1creditcard.com
- *.1integrations.com
- *.x1.co
- *.x1creditcard.com
- fusion.tradepmr.com - Production environment and TradePMR application.
- www.tradepmr.com
- insight2.tradepmr.com
- *.bitstamp.net - All Bitstamp supporting services and subdomains which are listed below. Details about APIs can be found here: https://www.bitstamp.net/api/ Subdomains pointing to third-party services are not in scope.
- Id1406825640 - Bitstamp iOS application
- net.bitstamp.app - Bitstamp Android application
Out of Scope
- shop.robinhood.com - Report findings to Brilliant Made https://www.brilliantmade.com/
- fleet.infra.robinhood.net
- content.research.robinhood.com - Report findings to https://www.GreatQuestion.co
- events.robinhood.com
- www.saytechnologies.com/contact/sales
- affiliates.robinhood.com
- vgs-api.robinhood.com
- share.robinhood.com
- affiliates.robinhood.com
- esg.robinhood.com
- startinvesting.robinhood.com
- go.robinhood.com
- underthehoodpod.robinhood.com
- press.robinhood.com
- roadshow.robinhood.com
- weareallinvestors.robinhood.com
- careers.robinhood.com
- earlytalent.robinhood.comauth-sandbox.tradepmr.com
- api-sandbox.tradepmr.com
- fusion-demo.tradepmr.com
- fusion-demo.uat.tradepmr.com
- fusion-demo.uat2.tradepmr.com
- fusion.uat.tradepmr.com
- fusion.uat2.tradepmr.com
- fusion.uat3.tradepmr.com
- auth-validation.tradepmr.com
- api-validation.tradepmr.com
- auth.tradepmr.com
- api.tradepmr.com
- sandbox.bitstamp.net
We consider most informative-type issues to be out of scope, like SPF issues. If most other bug bounty programs exclude it, we likely would too.
- Physical attacks against Robinhood employees, offices, or data centers
- Social engineering attacks against Robinhood employees or users, including phishing
- Vulnerabilities in third-party integrations with the Robinhood API or third-party banking functionality (e.g. credit card chargebacks made through your financial institution)
- Vulnerabilities that require physical access, rooted / jailbroken devices, or debug access to a user’s device
- Denial of service without prior authorization
- Subdomain takeover without taking over the subdomain
- Cache poisoning
- Email list or notification setting configuration issues or information disclosure
- Clickjacking without impact
- Disclosure of publicly available information
- Lack of security flags in cookies (except session cookies)
- Lack of security headers unless exploitable
- Vulnerabilities caused by out-of-date browsers or browser add-ons
- Vulnerabilities caused by out-of-date or no longer maintained Android or iOS versions
- Mobile application root and jailbreak detection
- For Say Technologies: Voting information disclosure via IDOR, and anything including contact or support forms
- DNS records including email policy (SPF, DKIM, DMARC), DNSSEC
- Issues related to unsafe SSL/TLS cipher suites or protocol versions unless exploitable
- Lack of EXIF stripping on uploads, unless those uploads are publicly accessible
- Logout CSRF
Additionally HackerOne has core ineligible findings that are applicable to this program