BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.
Programs / Goldman Sachs

In brief. Goldman Sachs is a bug bounty program on HackerOne. Its critical reports have paid an average of $15,000 across 26 reports (HackerOne figures, November 10, 2026). It received 142 reports in the 90 days to November 10, 2026, about 2.8 per in-scope asset. As of Nov 10, 2026. Markdown for agents

NR Unrated

Goldman Sachs

Goldman Sachs HackerOne
3 more reviews needed for a grade
Write a review
Program page hackerone.com ↗
Claim this company profile

Work at Goldman Sachs? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 10 Nov 2026.

What it pays, by severity

Critical $15,000 avg 26 reports firm
High $4,303 avg 76 reports firm
Medium $1,733 avg 242 reports firm
Low $342 avg 150 reports firm

$886,406 paid to researchers in total, $82,083 of it in the last 90 days. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received
142
in 90 days
Resolved
523
all time, last one 17 days ago
Participants
570
hunters engaged
Response efficiency
100%
meeting its targets, HackerOne’s figure
SLA misses
0
targets missed
Reports received, day by day, last 30 days 128–150
11 Oct 142 reports 10 Nov

Response targets it sets itself

First response
1 day
Triage
3 days
Bounty
30 days
Resolution
30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

Open to submit. HackerOne lists no requirements for submitting a report here.

Over 82 days (57 snapshots): intake up 9 reports; response efficiency up 4 points; 90-day payout up $50,015.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

601 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

# Researcher Reputation Recognised / submitted
1 todayisnew 610 46 / 85 54%
2 lpi 461 20 / 22 91%
3 0ang3el 378 9 / 12 75%
4 d0xing 363 13 / 16 81%
5 rhynorater 358 9 / 11 82%
6 co0nan 350 10 / 16 63%
6 m0chan 350 17 / 31 55%
8 huh0x 332 11 / 48 23%
9 mikee 319 17 / 30 57%
10 shubs 307 11 / 18 61%
11 0xd0m7 292 10 / 11 91%
12 niemand_sec 259 7 / 15 47%
13 hipotermia 238 8 / 8 100%
14 kphaks 202 7 / 11 64%
15 sw33tlie 196 6 / 7 86%
15 gooohacker 22 1 / 3 33%
16 xsam 194 7 / 8 88%
17 p4fg 193 9 / 12 75%
17 stenoplasma 193 4 / 4 100%
19 damian89 175 6 / 11 55%
20 m0uka 172 6 / 18 33%
20 nagli 172 3 / 14 21%
22 godiego 168 15 / 25 60%
23 erickfernandox 164 13 / 21 62%
24 bsysop 157 3 / 7 43%

Showing the top 25 of 601 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 8 Nov 2026.

Responsiveness
100% HackerOne’s figure
Swag
Offered
Currency
USD
Submissions
Open
Launched
May 2018
Scope entries
79 HackerOne’s count

Scope

79 assets
AssetTypeEligibilityMax severity
*.advisorsolutions.gs.com OTHER ✓ bounty Critical
*.ayco.com URL ✓ bounty Critical
*.folioclient.com OTHER ✓ bounty Critical
*.foliodigitalwealth.com OTHER ✓ bounty None
*.foliofirst.com OTHER ✓ bounty None
Show all 79 assets
AssetTypeEligibilityMax severity
*.foliofn.com OTHER ✓ bounty Critical
*.folioidentity.com OTHER ✓ bounty Critical
*.folioinstitutional.com OTHER ✓ bounty Critical
*.folioinvesting.com OTHER ✓ bounty Critical
*.global-liquidity.gs.com URL ✓ bounty Critical
*.goldman.com URL ✓ bounty Critical
*.goldmanpfm.com URL ✓ bounty Critical
*.goldmansachs.com URL ✓ bounty Critical
*.gs-mosaic.gs.com URL ✓ bounty Critical
*.gs-mosaic.qa.gs.com URL ✓ bounty Critical
*.gs.com URL ✓ bounty Critical
*.gs.de URL ✓ bounty Critical
*.gsam.com URL ✓ bounty Critical
*.gspublishing.com URL ✓ bounty Critical
*.gsselect.com URL ✓ bounty Critical
*.honestdollar.com URL ✓ bounty Critical
*.marcus.co.uk URL ✓ bounty Critical
*.marcus.com URL ✓ bounty Critical
*.nextcapital.com OTHER ✓ bounty Critical
*.nnip.com OTHER ✓ bounty Critical
*.qaglobal-liquidity.gs.com URL ✓ bounty Critical
api.foliofn.com URL ✓ bounty Critical
apigw.foliofn.com URL ✓ bounty Critical
com.gs.gsnow.external APPLE STORE APP ID ✓ bounty Critical
com.gs.gstrader.external APPLE STORE APP ID ✓ bounty Critical
com.gs.mobile.gsnow GOOGLE PLAY APP ID ✓ bounty Critical
com.gs.mobile.trader GOOGLE PLAY APP ID ✓ bounty Critical
com.gs.pfmg.wellness GOOGLE PLAY APP ID ✓ bounty Critical
com.gs.pwmdigital.external APPLE STORE APP ID ✓ bounty Critical
com.gs.pwmdigital.external.android GOOGLE PLAY APP ID ✓ bounty Critical
com.marcus.android GOOGLE PLAY APP ID ✓ bounty Critical
com.marcus.android.uk GOOGLE PLAY APP ID ✓ bounty Critical
com.marcus.ios-uk APPLE STORE APP ID ✓ bounty Critical
com.marcus.ios-us APPLE STORE APP ID ✓ bounty Critical
developer.gs.com URL ✓ bounty Critical
goldmansachsindices.com URL ✓ bounty Critical
GS Select iOS app APPLE STORE APP ID ✓ bounty Critical
marquee.gs.com URL ✓ bounty Critical
research.gs.com URL ✓ bounty Critical
www.fitvermogen.nl URL ✓ bounty Critical
*.claritymoney.com URL submit only Critical
*.clientevents.gs.com WILDCARD out None
*.communicatie.vennhypotheken.nl OTHER out None
*.events.gs.com WILDCARD out None
*.finlife.com URL submit only Critical
*.finlifepartners.com URL submit only Critical
*.genesiscapital.com URL out None
*.my.nnip.com OTHER out None
*.overrules.vennhypotheken.nl OTHER out None
*.rocaton.com,secure.rocaton.com URL out None
*.scripts.vennhypotheken.nl OTHER out None
*.subscriptions.gs.com URL out None
*.unitedcp.com URL submit only Critical
*.vennhypotheken.nl OTHER out None
*.xs2a.goldman.com OTHER out None
10ksbv.eo.gs.com URL out None
18098.nextcapital.com URL out None
3rd party hosted assets OTHER out None
All .cn domains OTHER out None
billpay.goldman.com URL out None
blackinbusiness.gs.com URL out None
deb.nextcapital.com URL out None
email.nextcapital.com URL out None
gset.gs.com URL out None
gsg-uk.goldman.com URL out None
gsg.goldman.com URL out None
gspf.goldman.com URL out None
https://github.com/finos/CatchIT SOURCE CODE submit only Critical
npm-new.nextcapital.com URL out None
npm.nextcapital.com URL out None
qa-billpay.goldman.com URL out None
repo.nextcapital.com URL out None
rubygems.nextcapital.com URL out None
www.rocaton.com URL out None