# GoodRx: bug bounty program on HackerOne

> GoodRx is a bug bounty program on HackerOne. It received 28 reports in the 90 days to November 7, 2026, about 2 per in-scope asset.

- **Company:** GoodRx
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/goodrx
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** January 30, 2020
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/goodrx

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | not published | 9 |
| High | not published | 19 |
| Medium | not published | 87 |
| Low | not published | 89 |

- Reports received in the last 90 days: 28 (about 2 per in-scope asset)
- Bounties paid in total: $70,000
- Researchers participating: 153
- Response efficiency: 60%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 30 days
- Barriers: bounty amounts hidden

## Scope

As imported from HackerOne on November 6, 2026: 14 assets in scope (11 bounty-eligible), 10 out of scope. The policy page is the authority.

- `10.0.0.0/8` (CIDR): in scope, bounty-eligible, max severity critical
- `api.goodrx.com` (URL): in scope, bounty-eligible, max severity high
- `co.heydoctor.android` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `com.goodrx` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity critical
- `com.goodrx.iphone` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `com.heydoctor.iphone` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity critical
- `gold.goodrx.com` (URL): in scope, bounty-eligible, max severity critical
- `heydoctor.goodrx.com` (URL): in scope, bounty-eligible, max severity critical
- `m.goodrx.com` (URL): in scope, bounty-eligible, max severity critical
- `www.goodrx.com` (URL): in scope, bounty-eligible, max severity critical
- `www.hellogoodrx.com` (URL): in scope, bounty-eligible, max severity critical
- `api.heydoctor.com` (URL): out of scope, max severity none
- `bugbounty-stage.goodrxbenefits.com` (URL): out of scope, max severity none
- `com.goodrx.doctors` (APPLE_STORE_APP_ID): out of scope, max severity none
- `com.goodrx.gold` (APPLE_STORE_APP_ID): out of scope, max severity none
- `graph.goodrx.com` (URL): in scope, no bounty, max severity critical
- `http://securetest.scriptcycle.com` (URL): in scope, no bounty, max severity critical
- `investors.goodrx.com` (URL): out of scope, max severity none
- `remote.goodrx.com` (OTHER): out of scope, max severity none
- `remote2.goodrx.com` (URL): out of scope, max severity none
- `sso.identity.goodrx.com` (URL): out of scope, max severity none
- `support.goodrx.com` (URL): out of scope, max severity none
- `www.iodine.com` (URL): out of scope, max severity none
- `GoodRx #1 2023 - iOS transfer scope` (OTHER): in scope, no bounty, max severity none

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.