In brief. Razorpay is a bug bounty program on HackerOne. Its critical reports have paid an average of $200 across 4 reports (HackerOne figures, November 8, 2026). It received 36 reports in the 90 days to November 8, 2026, about 6 per in-scope asset. As of Nov 8, 2026. Markdown for agents

NR Unrated

Razorpay

Razorpay HackerOne

3 more reviews needed for a grade

Write a review

Program page hackerone.com ↗

Claim this company profile

Work at Razorpay? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you'd rather not deal with the vendor yourself, a BugRater analyst will submit it to them for you, with your explicit permission, and tell you what they said.

Ask BugRater to submit it

Reports are private. The report body is encrypted at rest. BugRater holds the key, so the analyst handling your report can read it, and we log every time someone does.

Program metrics HackerOne, published

These are HackerOne’s own figures for this program, taken from its public page. Researchers did not report them, and they don't count toward the BugRater grade. Captured 8 Nov 2026.

What it pays, by severity

Critical $200 avg 4 reports thin

High amount not published 28 reports

Medium $233 avg 44 reports firm

Low $100 avg 59 reports firm

$46,911 paid to researchers in total, $1,100 of it in the last 90 days. This is HackerOne’s lifetime figure. It shows the program has paid out before. It doesn't tell you what any one report will get.

Intake & responsiveness, last 90 days

Reports received

in 90 days

Resolved

not published

all time, last one 2 months ago

Participants

143

hunters engaged

Response efficiency

43%

below its own targets, HackerOne’s figure

SLA misses

targets missed

Reports received, day by day, last 30 days 36–52

9 Oct 36 reports 8 Nov

Response targets it sets itself

First response

1 day

Triage

10 days

Bounty

14 days

Resolution

30 days

These are targets the program set. They don't show whether it meets them.

Barriers to submitting

Open to submit. HackerOne lists no requirements for submitting a report here.

Over 78 days (54 snapshots): intake down 50 reports; response efficiency down 35 points.

See how this program’s report load compares to others

Reviews

0 published

No reviews yet.

Be the first to review

Who this program credits

150 credited

Researchers HackerOne shows on this program’s public thanks list, best position first. “Recognised” is how many of a hunter’s submissions the program accepted; the ratio is their signal here, not our judgement of them.

#	Researcher	Reputation	Recognised / submitted
1	armaanpathan	186	8 / 13 62%
2	mukundrana	146	5 / 15 33%
3	johnh4x0r	135	5 / 10 50%
4	d0xing	130	5 / 8 63%
5	dexter0us	123	4 / 5 80%
6	imranhudaa	101	5 / 35 14%
7	n1had	98	6 / 17 35%
8	jatindhankhar	79	2 / 3 67%
9	tulswani	78	4 / 7 57%
9	vampirex	66	3 / 4 75%
10	holybugx	66	3 / 6 50%
11	todayisnew	65	5 / 12 42%
12	akhil-reni	64	2 / 4 50%
12	homosec	64	2 / 2 100%
12	mole_concept	64	2 / 2 100%
15	thaivu	59	1 / 6 17%
16	africae	57	2 / 2 100%
16	dls_	57	1 / 1 100%
16	gallotg	57	1 / 3 33%
16	jamz96	57	1 / 1 100%
16	missoum1307	57	1 / 1 100%
16	renniepak	57	1 / 1 100%
16	stealthy	57	1 / 1 100%
16	steppe	57	1 / 1 100%
24	nervhym	54	2 / 8 25%

Showing the top 25 of 150 credited on HackerOne.

Program profile HackerOne, imported

HackerOne published these facts on the program's page. Researchers did not report them, and they don't count toward the BugRater grade. Last checked 6 Nov 2026.

Neobanking for Businesses

Responsiveness

43% HackerOne’s figure

Swag

Currency

USD

Submissions

Open

Launched

May 2022

Scope entries

6 HackerOne’s count

Scope

6 assets

Asset	Type	Eligibility	Max severity
api.razorpay.com	URL	✓ bounty	Critical
checkout.razorpay.com	URL	✓ bounty	Critical
dashboard.razorpay.com	URL	✓ bounty	Critical
invoices.razorpay.com	URL	✓ bounty	Critical
payroll.razorpay.com	URL	✓ bounty	Critical

Show all 6 assets

Asset	Type	Eligibility	Max severity
x.razorpay.com	URL	✓ bounty	Critical