Featured on
Featured on
how we sort the index, not an estimate of what you’ll earn
Attack surface
39 in-scope
*.ayco.comscope· critical*.claritymoney.comscope· critical*.global-liquidity.gs.comscope· critical*.goldman.comscope· critical*.goldmanpfm.comscope· critical*.goldmansachs.comscope· critical*.gs-mosaic.gs.comscope· critical*.gs-mosaic.qa.gs.comscope· critical*.gs.comscope· critical*.gs.descope· critical*.gsam.comscope· critical*.gspublishing.comscope· critical*.gsselect.comscope· critical*.honestdollar.comscope· critical*.marcus.co.ukscope· critical*.marcus.comscope· critical*.qaglobal-liquidity.gs.comscope· criticalapigw.foliofn.com· criticaldeveloper.gs.com· criticalgoldmansachsindices.com· criticalmarquee.gs.com· criticalresearch.gs.com· criticalGS Select iOS app· criticalcom.gs.gsnow.external· criticalcom.gs.pwmdigital.external· criticalcom.marcus.ios-uk· criticalcom.marcus.ios-us· critical*.folioclient.comscope· critical*.foliofn.comscope· critical*.folioidentity.comscope· critical*.folioinstitutional.comscope· critical*.advisorsolutions.gs.comscope· critical*.nextcapital.comscope· critical*.nnip.comscope· criticalcom.gs.mobile.gsnow· criticalcom.gs.pfmg.wellness· criticalcom.gs.pwmdigital.external.android· criticalcom.marcus.android· criticalcom.marcus.android.uk· critical*.rocaton.com,secure.rocaton.com18098.nextcapital.combillpay.goldman.comdeb.nextcapital.comemail.nextcapital.comgsg-uk.goldman.comgsg.goldman.comgspf.goldman.comnpm-new.nextcapital.comnpm.nextcapital.com*.communicatie.vennhypotheken.nl*.overrules.vennhypotheken.nl*.scripts.vennhypotheken.nl*.vennhypotheken.nl3rd party hosted assetsAll .cn domains− removed 2 scopes · com.gs.gstrader.external, com.gs.mobile.trader
13d ago
− removed 4 scopes
22d ago
− removed 1 scope · *.vennhypotheken.nl
36d ago
first indexed
92d ago · 46 in-scope assets
No reports yet. Be the first to share your triage timing for Goldman Sachs.
// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.
{
"id": 0,
"url": "https://hackerone.com/goldmansachs",
"name": "Goldman Sachs",
"handle": "goldmansachs",
"targets": {
"in_scope": [
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "critical",
"asset_identifier": "*.advisorsolutions.gs.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.ayco.com",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.claritymoney.com",
"eligible_for_bounty": false,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "OTHER",
"instruction": "This site is in the process of being retired. Only Critical, High issues will be considered for bounty",
"max_severity": "critical",
"asset_identifier": "*.folioclient.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "This site is in the process of being retired. Only Critical, High issues will be considered for bounty",
"max_severity": "critical",
"asset_identifier": "*.foliofn.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "This site is in the process of being retired. Only Critical, High issues will be considered for bounty",
"max_severity": "critical",
"asset_identifier": "*.folioidentity.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "This site is in the process of being retired. Only Critical, High issues will be considered for bounty",
"max_severity": "critical",
"asset_identifier": "*.folioinstitutional.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.global-liquidity.gs.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.goldman.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Avoid all active testing on contact and registration forms, such as \"Contact us\", \"Register for a Demo\", and \"Speak With a Financial Advisor\". These forms may generate emails that will affect the business. If we start receiving test submissions on these forms, we may have to pause eligibility for these sites.",
"max_severity": "critical",
"asset_identifier": "*.goldmanpfm.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "This is Goldman Sachs' main website. ",
"max_severity": "critical",
"asset_identifier": "*.goldmansachs.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.gs-mosaic.gs.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.gs-mosaic.qa.gs.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.gs.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Includes:\n*.gs.de\n*.gsmarkets.de\n*.gsmarkets.nl\n*.gsmarkets.at\n*.gsmarkets.be\n\nExcludes the 3rd party hosted site:\nclassic.gs.de\n\nIn scope sites may display a page overlay to US visitors which can be hidden using an adblocker like uBlock Origin",
"max_severity": "critical",
"asset_identifier": "*.gs.de",
"eligible_for_bounty": true,
"integrity_requirement": "not_defined",
"eligible_for_submission": true,
"availability_requirement": "not_defined",
"confidentiality_requirement": "not_defined"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.gsam.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.gspublishing.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.gsselect.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.honestdollar.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.marcus.co.uk",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Note that *.e.e.marcus.com is Out of Scope",
"max_severity": "critical",
"asset_identifier": "*.marcus.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Any domain pointing to a third party service that is not a cloud provider is out of scope for testing. If unsure whether an asset is in scope, please reach out to bugbounty@gs.com before testing.",
"max_severity": "critical",
"asset_identifier": "*.nextcapital.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "Note that NNIP was acquired by Goldman Sachs from NN Group. Please ensure that the asset you're testing is indeed owned and managed by Goldman Sachs and isn't in fact an NN Group asset. When in doubt please reach out to us at bugbounty@gs.com to confirm, before starting your testing.",
"max_severity": "critical",
"asset_identifier": "*.nnip.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "*.qaglobal-liquidity.gs.com",
"eligible_for_bounty": true,
"integrity_requirement": "high",
"eligible_for_submission": true,
"availability_requirement": "high",
"confidentiality_requirement": "high"
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "[GS Select iOS app](https://apps.apple.com/us/app/gs-select/id1634151697)",
"max_severity": "critical",
"asset_identifier": "GS Select iOS app",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "This site is in the process of being retired. Only Critical, High issues will be considered for bounty",
"max_severity": "critical",
"asset_identifier": "apigw.foliofn.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "[GS Now iOS](https://apps.apple.com/us/app/gs-now/id1473474041)",
"max_severity": "critical",
"asset_identifier": "com.gs.gsnow.external",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "[GS Now Android](https://play.google.com/store/apps/details?id=com.gs.mobile.gsnow)",
"max_severity": "critical",
"asset_identifier": "com.gs.mobile.gsnow",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "[Goldman Sachs Wellness Android](https://play.google.com/store/apps/details?id=com.gs.pfmg.wellness&hl=en_IN&gl=US)",
"max_severity": "critical",
"asset_identifier": "com.gs.pfmg.wellness",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "[GS PWM iOS](https://apps.apple.com/us/app/gs-pwm/id1440077444)",
"max_severity": "critical",
"asset_identifier": "com.gs.pwmdigital.external",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "[GS PWM Android](https://play.google.com/store/apps/details?id=com.gs.pwmdigital.external.android)",
"max_severity": "critical",
"asset_identifier": "com.gs.pwmdigital.external.android",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "[Marcus US Android](https://play.google.com/store/apps/details?id=com.marcus.android&hl=en_IN&gl=US)",
"max_severity": "critical",
"asset_identifier": "com.marcus.android",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "GOOGLE_PLAY_APP_ID",
"instruction": "[Marcus UK: Online Savings Bank Android](https://play.google.com/store/apps/details?id=com.marcus.android.uk)",
"max_severity": "critical",
"asset_identifier": "com.marcus.android.uk",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "[Marcus UK: Online savings bank](https://apps.apple.com/gb/app/marcus-uk-online-savings-bank/id1489511701)",
"max_severity": "critical",
"asset_identifier": "com.marcus.ios-uk",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "APPLE_STORE_APP_ID",
"instruction": "[Marcus by Goldman Sachs](https://apps.apple.com/us/app/marcus-save-borrow-invest/id1489511701)",
"max_severity": "critical",
"asset_identifier": "com.marcus.ios-us",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "developer.gs.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "goldmansachsindices.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "marquee.gs.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "critical",
"asset_identifier": "research.gs.com",
"eligible_for_bounty": true,
"integrity_requirement": null,
"eligible_for_submission": true,
"availability_requirement": null,
"confidentiality_requirement": null
}
],
"out_of_scope": [
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "none",
"asset_identifier": "*.communicatie.vennhypotheken.nl",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "WILDCARD",
"instruction": "Any similar events pages are also all out of scope. These are all usually hosted by a vendor and as such we can't authorize testing on these assets. Please check in with us at bugbounty@gs.com when in doubt about an asset being in scope",
"max_severity": "none",
"asset_identifier": "*.events.gs.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "none",
"asset_identifier": "*.overrules.vennhypotheken.nl",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "*.rocaton.com,secure.rocaton.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "none",
"asset_identifier": "*.scripts.vennhypotheken.nl",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": null,
"max_severity": "none",
"asset_identifier": "*.vennhypotheken.nl",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "18098.nextcapital.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "OTHER",
"instruction": "All 3rd party / vendor hosted assets are considered Out of Scope for the program. As these assets are not hosted by us, we can't authorize testing on them. Please check in with us at bugbounty@gs.com when in doubt about an asset being in scope. Some examples of such OOS vendor hosted applications are (**note that this is not an exhaustive list**):\n\n*.subscriptions.gs.com\ngset.gs.com\n10ksbv.eo.gs.com\nui.appointments.ayco.com\ndeveloper.xs2a.goldman.com\nclientevents.gs.com\ngoldman-sachs.ch\ngoldman-sachs.it\ngoldmansachs.tal.net\ngswarrants.com.hk\nblackinbusiness.gs.com\nskfondy.gs.com\nczfondy.gs.com\ne.e.marcus.com",
"max_severity": "none",
"asset_identifier": "3rd party hosted assets",
"eligible_for_bounty": false,
"integrity_requirement": "none",
"eligible_for_submission": false,
"availability_requirement": "none",
"confidentiality_requirement": "none"
},
{
"asset_type": "OTHER",
"instruction": "Please note that all GS assets with .cn domains are Out of scope",
"max_severity": "none",
"asset_identifier": "All .cn domains",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "billpay.goldman.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "deb.nextcapital.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "email.nextcapital.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "Do not pentest",
"max_severity": "none",
"asset_identifier": "gsg-uk.goldman.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "gsg.goldman.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "gspf.goldman.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "npm-new.nextcapital.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "npm.nextcapital.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": "",
"max_severity": "none",
"asset_identifier": "qa-billpay.goldman.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "repo.nextcapital.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
},
{
"asset_type": "URL",
"instruction": null,
"max_severity": "none",
"asset_identifier": "rubygems.nextcapital.com",
"eligible_for_bounty": false,
"integrity_requirement": null,
"eligible_for_submission": false,
"availability_requirement": null,
"confidentiality_requirement": null
}
]
},
"website": "https://www.goldmansachs.com/",
"offers_swag": true,
"managed_program": true,
"offers_bounties": true,
"submission_state": "open",
"allows_bounty_splitting": true,
"average_time_to_bounty_awarded": 190,
"response_efficiency_percentage": 99,
"average_time_to_report_resolved": 3756,
"average_time_to_first_program_response": 1
}