BugHunters — Bug Bounty Platform
    Back to Programs
    Robinhood

    Robinhood

    Fintech

    Commission-free trading platform democratizing finance with stocks, ETFs, options, and cryptocurrency trading.

    https://robinhood.com

    Max Reward

    $25,000

    Total Paid

    $1,900,000

    Resolved

    234

    Avg Response

    2 days

    In-Scope Assets

    robinhood.com

    Trading platform and portfolio management

    Robinhood API

    Trading and account APIs

    Robinhood Mobile

    iOS and Android trading apps

    Robinhood Crypto

    Cryptocurrency trading features

    Out of Scope

    • ✕ Robinhood Learn content
    • ✕ Marketing materials
    • ✕ Customer support portals

    Severity Levels & Rewards

    Critical

    RCE, authentication bypass, privilege escalation, fund extraction

    High

    Stored XSS, CSRF with impact, API abuse, data manipulation

    Medium

    Reflected XSS, data leakage, logic flaws, information disclosure

    Low

    Verbose errors, minor config issues, low-impact info disclosure

    Active Bounties (2)

    IDTitleSeverityStatusRewardSubmissions
    RH-001Options trading restriction bypass via API parameter injection
    High
    Open
    		$5,000–$15,0000
    RH-002Portfolio value manipulation via stale price cache
    Medium
    In Review
    		$2,000–$5,0001

    Rules of Engagement

    • Do not access, modify, or delete data belonging to other users.

    • Do not perform denial-of-service attacks or automated scanning at high volume.

    • Report vulnerabilities promptly and provide sufficient detail to reproduce.

    • Allow reasonable time for fix before public disclosure (90 days).

    • Safe harbor: We will not pursue legal action against researchers acting in good faith within these rules.