# Faraday, Inc.: bug bounty program on HackerOne

> Faraday, Inc. is a bug bounty program on HackerOne. Its critical reports have paid an average of $1,733 across 6 reports (HackerOne figures, November 8, 2026). It received 101 reports in the 90 days to November 8, 2026, about 7.2 per in-scope asset.

- **Company:** Faraday, Inc.
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/faraday_inc
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** September 4, 2020
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/faraday-inc

## Payouts and volume

HackerOne's own published figures, captured November 8, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $1,733 | 6 |
| High | $750 | 4 |
| Medium | $357 | 34 |
| Low | $75 | 8 |

- Reports received in the last 90 days: 101 (about 7.2 per in-scope asset)
- Bounties paid in the last 90 days: $8,750
- Bounties paid in total: $24,185
- Researchers participating: 53
- Response efficiency: 97%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days

## Scope

As imported from HackerOne on November 8, 2026: 14 assets in scope (14 bounty-eligible), 8 out of scope. The policy page is the authority.

- `api.faraday.ai` (URL): in scope, bounty-eligible, max severity critical
- `api.pro.faraday.ai` (URL): in scope, bounty-eligible, max severity critical
- `api.row.pro` (URL): in scope, bounty-eligible, max severity critical
- `app.faraday.ai` (URL): in scope, bounty-eligible, max severity critical
- `app.faraday.io` (URL): in scope, bounty-eligible, max severity critical
- `BigQuery` (OTHER): in scope, bounty-eligible, max severity critical
- `buy.faraday.ai` (URL): in scope, bounty-eligible, max severity critical
- `gs://faraday-secret` (OTHER): in scope, bounty-eligible, max severity critical
- `gs://fdy-production-sdk-uploads` (OTHER): in scope, bounty-eligible, max severity critical
- `mcp.faraday.ai` (URL): in scope, bounty-eligible, max severity critical
- `pro.faraday.ai` (URL): in scope, bounty-eligible, max severity critical
- `row.pro` (URL): in scope, bounty-eligible, max severity critical
- `s3://faraday-secret` (OTHER): in scope, bounty-eligible, max severity critical
- `vault2.faraday.ai` (URL): in scope, bounty-eligible, max severity critical
- `faraday.ai` (URL): out of scope, max severity none
- `faraday.atlassian.net` (URL): out of scope, max severity none
- `faraday.io` (URL): out of scope, max severity none
- `pay.faraday.io` (URL): out of scope, max severity none
- `s3://faraday-uploads` (OTHER): out of scope, max severity none
- `Support Live Chat` (OTHER): out of scope, max severity none
- `www.faraday.ai` (URL): out of scope, max severity none
- `www.faraday.io` (URL): out of scope, max severity none

---

Generated November 9, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.