BugRater
Early access. The directory is still filling out, and every rating here comes from a researcher's reported experience.
Programs / GoodRx

In brief. GoodRx is a bug bounty program on HackerOne. It received 28 reports in the 90 days to November 7, 2026, about 2 per in-scope asset. As of Nov 7, 2026. Markdown for agents

NR Unrated

GoodRx

GoodRx HackerOne
3 more reviews needed for a grade
Write a review
Program page hackerone.com ↗
Claim this company profile

Work at GoodRx? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 7 Nov 2026.

What it pays, by severity

Critical amount not published 9 reports
High amount not published 19 reports
Medium amount not published 87 reports
Low amount not published 89 reports

$70,000 paid to researchers in total. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received
28
in 90 days
Resolved
216
all time, last one 8 months ago
Participants
153
hunters engaged
Response efficiency
60%
below its own targets, HackerOne’s figure
SLA misses
0
targets missed
Reports received, day by day, last 29 days 16–28
9 Oct 28 reports 7 Nov

Response targets it sets itself

First response
1 day
Triage
2 days
Bounty
30 days
Resolution
30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

bounty amounts hidden

Over 79 days (54 snapshots): intake up 9 reports; response efficiency down 14 points.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

157 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

# Researcher Reputation Recognised / submitted
1 flashdisk 344 13 / 15 87%
2 bugra 222 6 / 7 86%
3 p1security 200 5 / 5 100%
4 inzo_ 178 3 / 3 100%
5 yashrs 177 6 / 7 86%
6 mjyintl 170 30 / 31 97%
7 xsam 160 5 / 5 100%
8 sameerphad72 158 9 / 12 75%
9 0xbastion 156 10 / 12 83%
10 kazan71p 133 4 / 4 100%
11 ro_ 110 6 / 6 100%
12 shailesh4594 103 4 / 4 100%
13 m0chan 95 5 / 8 63%
14 bekziz 88 5 / 7 71%
15 michael1026 79 2 / 2 100%
16 sup3r-b0y 69 7 / 11 64%
17 chernobyl 66 9 / 18 50%
17 cipher0x30 66 3 / 8 38%
19 ansleon 63 9 / 9 100%
20 swajyadip 62 1 / 1 100%
21 abhisec0 61 3 / 7 43%
22 tolo7010 58 4 / 12 33%
23 fraidayyy 57 1 / 1 100%
23 mister_mime 57 1 / 1 100%
23 nakyamad 57 1 / 1 100%

Showing the top 25 of 157 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 6 Nov 2026.

GoodRx is America’s #1 prescription price transparency platform and healthcare marketplace. We help consumers save up to 80% on their medications.

Responsiveness
61% HackerOne’s figure
Swag
No
Currency
USD
Submissions
Open
Launched
Jan 2020
Scope entries
26 HackerOne’s count

Scope

24 assets
AssetTypeEligibilityMax severity
10.0.0.0/8 CIDR ✓ bounty Critical
api.goodrx.com URL ✓ bounty High
co.heydoctor.android GOOGLE PLAY APP ID ✓ bounty Critical
com.goodrx GOOGLE PLAY APP ID ✓ bounty Critical
com.goodrx.iphone APPLE STORE APP ID ✓ bounty Critical
Show all 24 assets
AssetTypeEligibilityMax severity
com.heydoctor.iphone APPLE STORE APP ID ✓ bounty Critical
gold.goodrx.com URL ✓ bounty Critical
heydoctor.goodrx.com URL ✓ bounty Critical
m.goodrx.com URL ✓ bounty Critical
www.goodrx.com URL ✓ bounty Critical
www.hellogoodrx.com URL ✓ bounty Critical
api.heydoctor.com URL out None
bugbounty-stage.goodrxbenefits.com URL out None
com.goodrx.doctors APPLE STORE APP ID out None
com.goodrx.gold APPLE STORE APP ID out None
graph.goodrx.com URL submit only Critical
http://securetest.scriptcycle.com URL submit only Critical
investors.goodrx.com URL out None
remote.goodrx.com OTHER out None
remote2.goodrx.com URL out None
sso.identity.goodrx.com URL out None
support.goodrx.com URL out None
www.iodine.com URL out None
GoodRx #1 2023 - iOS transfer scope OTHER not set None

HackerOne lists 26 scope entries. Its public listing groups many assets under one label, so we show identical entries once.