Goldman Sachs Bug Bounty Program on Hackerone

{ "allows_bounty_splitting": true, "average_time_to_bounty_awarded": 215, "average_time_to_first_program_response": 1, "average_time_to_report_resolved": 6074, "handle": "goldmansachs", "id": 0, "managed_program": true, "name": "Goldman Sachs", "offers_bounties": true, "offers_swag": true, "response_efficiency_percentage": 97, "submission_state": "open", "url": "https://hackerone.com/goldmansachs", "website": "https://www.goldmansachs.com/", "targets": { "in_scope": [ { "asset_identifier": "*.advisorsolutions.gs.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.ayco.com", "asset_type": "URL", "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "not_defined", "max_severity": "critical" }, { "asset_identifier": "*.claritymoney.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": false, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.folioclient.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.foliodigitalwealth.com", "asset_type": "OTHER", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "This site is in the process of being retired. Only Critical issues will be considered for bounty", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "*.foliofirst.com", "asset_type": "OTHER", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "This site is in the process of being retired. Only Critical issues will be considered for bounty", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "*.foliofn.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.folioidentity.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.folioinstitutional.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.folioinvesting.com", "asset_type": "OTHER", "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "This site is in the process of being retired. Only Critical issues will be considered for bounty", "integrity_requirement": "not_defined", "max_severity": "critical" }, { "asset_identifier": "*.global-liquidity.gs.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.goldman.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.goldmanpfm.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Avoid all active testing on contact and registration forms, such as \"Contact us\", \"Register for a Demo\", and \"Speak With a Financial Advisor\". These forms may generate emails that will affect the business. If we start receiving test submissions on these forms, we may have to pause eligibility for these sites.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.goldmansachs.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "This is Goldman Sachs' main website. ", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.gs-mosaic.gs.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.gs-mosaic.qa.gs.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.gs.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.gs.de", "asset_type": "URL", "availability_requirement": "not_defined", "confidentiality_requirement": "not_defined", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Includes:\n*.gs.de\n*.gsmarkets.de\n*.gsmarkets.nl\n*.gsmarkets.at\n*.gsmarkets.be\n\nExcludes the 3rd party hosted site:\nclassic.gs.de\n\nIn scope sites may display a page overlay to US visitors which can be hidden using an adblocker like uBlock Origin", "integrity_requirement": "not_defined", "max_severity": "critical" }, { "asset_identifier": "*.gsam.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.gspublishing.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.gsselect.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "*.honestdollar.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.marcus.co.uk", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.marcus.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.nextcapital.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Any domain pointing to a third party service that is not a cloud provider is out of scope for testing. If unsure whether an asset is in scope, please reach out to bugbounty@gs.com before testing.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.nnip.com", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "Note that NNIP was acquired by Goldman Sachs from NN Group. Please ensure that the asset you're testing is indeed owned and managed by Goldman Sachs and isn't in fact an NN Group asset. When in doubt please reach out to us at bugbounty@gs.com to confirm, before starting your testing.", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "*.qaglobal-liquidity.gs.com", "asset_type": "URL", "availability_requirement": "high", "confidentiality_requirement": "high", "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": "high", "max_severity": "critical" }, { "asset_identifier": "GS Select iOS app", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[GS Select iOS app](https://apps.apple.com/us/app/gs-select/id1634151697)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "api.foliofn.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "apigw.foliofn.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": null, "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.gs.gsnow.external", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[GS Now iOS](https://apps.apple.com/us/app/gs-now/id1473474041)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.gs.gstrader.external", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Marquee Trader Mobile](https://apps.apple.com/us/app/marquee-trader-mobile/id1518269915)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.gs.mobile.gsnow", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[GS Now Android](https://play.google.com/store/apps/details?id=com.gs.mobile.gsnow)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.gs.mobile.trader", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Marquee Trader Android](https://play.google.com/store/apps/details?id=com.gs.mobile.trader&hl=en_IN&gl=US)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.gs.pfmg.wellness", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Goldman Sachs Wellness Android](https://play.google.com/store/apps/details?id=com.gs.pfmg.wellness&hl=en_IN&gl=US)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.gs.pwmdigital.external", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[GS PWM iOS](https://apps.apple.com/us/app/gs-pwm/id1440077444)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.gs.pwmdigital.external.android", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[GS PWM Android](https://play.google.com/store/apps/details?id=com.gs.pwmdigital.external.android)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.marcus.android", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Marcus US Android](https://play.google.com/store/apps/details?id=com.marcus.android&hl=en_IN&gl=US)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.marcus.android.uk", "asset_type": "GOOGLE_PLAY_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Marcus UK: Online Savings Bank Android](https://play.google.com/store/apps/details?id=com.marcus.android.uk)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.marcus.ios-uk", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Marcus UK: Online savings bank](https://apps.apple.com/gb/app/marcus-uk-online-savings-bank/id1489511701)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "com.marcus.ios-us", "asset_type": "APPLE_STORE_APP_ID", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "[Marcus by Goldman Sachs](https://apps.apple.com/us/app/marcus-save-borrow-invest/id1489511701)", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "developer.gs.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "goldmansachsindices.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "marquee.gs.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" }, { "asset_identifier": "research.gs.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": true, "eligible_for_submission": true, "instruction": "", "integrity_requirement": null, "max_severity": "critical" } ], "out_of_scope": [ { "asset_identifier": "*.communicatie.vennhypotheken.nl", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.events.gs.com", "asset_type": "WILDCARD", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Any similar events pages are also all out of scope. These are all usually hosted by a vendor and as such we can't authorize testing on these assets. Please check in with us at bugbounty@gs.com when in doubt about an asset being in scope", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.overrules.vennhypotheken.nl", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.rocaton.com,secure.rocaton.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.scripts.vennhypotheken.nl", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "*.vennhypotheken.nl", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "18098.nextcapital.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "3rd party hosted assets", "asset_type": "OTHER", "availability_requirement": "none", "confidentiality_requirement": "none", "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "All 3rd party / vendor hosted assets are considered Out of Scope for the program. As these assets are not hosted by us, we can't authorize testing on them. Please check in with us at bugbounty@gs.com when in doubt about an asset being in scope. Some examples of such OOS vendor hosted applications are (**note that this is not an exhaustive list**):\n\n*.subscriptions.gs.com\ngset.gs.com\n10ksbv.eo.gs.com\nui.appointments.ayco.com\ndeveloper.xs2a.goldman.com\nclientevents.gs.com\ngoldman-sachs.ch\ngoldman-sachs.it\ngoldmansachs.tal.net\ngswarrants.com.hk\nblackinbusiness.gs.com\nskfondy.gs.com\nczfondy.gs.com", "integrity_requirement": "none", "max_severity": "none" }, { "asset_identifier": "All .cn domains", "asset_type": "OTHER", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Please note that all GS assets with .cn domains are Out of scope", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "billpay.goldman.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "deb.nextcapital.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "email.nextcapital.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "gsg-uk.goldman.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "Do not pentest", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "gsg.goldman.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "gspf.goldman.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "npm-new.nextcapital.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "npm.nextcapital.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "qa-billpay.goldman.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": "", "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "repo.nextcapital.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" }, { "asset_identifier": "rubygems.nextcapital.com", "asset_type": "URL", "availability_requirement": null, "confidentiality_requirement": null, "eligible_for_bounty": false, "eligible_for_submission": false, "instruction": null, "integrity_requirement": null, "max_severity": "none" } ] } }

Goldman Sachs

In scope

Recent changes

Community reports

Your notes

Out of scope