Bug bounty program
Goldman Sachs
- Platform
- HackerOne
- Bounties
- Pays
- Assets in scope
- 39
- Disclosed reports
- 0
- Subdomains
- 4,659
Most upvoted reports0
No report of this program is publicly disclosed
Subdomains4,659
| Name | Scope | First seen |
|---|---|---|
| aimsdiligence.gsam.com | In scope | 2026-11-14 |
| uat.aimsdiligence.gsam.comtest | In scope | 2026-11-14 |
| www.aimsdiligence.gsam.com | In scope | 2026-11-14 |
| allvue.gsam.com | In scope | 2026-11-14 |
| orgin.allvue.gsam.com | In scope | 2026-11-14 |
| orgin-qa.allvue.gsam.comtest | In scope | 2026-11-14 |
| origin-qa.allvue.gsam.comtest | In scope | 2026-11-14 |
| qa.allvue.gsam.comtest | In scope | 2026-11-14 |
| www.qa.allvue.gsam.comtest | In scope | 2026-11-14 |
| www.allvue.gsam.com | In scope | 2026-11-14 |
| api.gsam.comapi | In scope | 2026-11-14 |
| allvue.api.gsam.comapi | In scope | 2026-11-14 |
| qa.allvue.api.gsam.comapi, test | In scope | 2026-11-14 |
| atlas.gsam.com | In scope | 2026-11-14 |
| uat.atlas.gsam.comtest | In scope | 2026-11-14 |
| www.uat.atlas.gsam.comtest | In scope | 2026-11-14 |
| www.atlas.gsam.com | In scope | 2026-11-14 |
| wwwqa.atlas.gsam.com | In scope | 2026-11-14 |
| internal.bdc.gsam.cominternal | In scope | 2026-11-14 |
| beta.gsam.comstaging | In scope | 2026-11-14 |
| internal.cdc.gsam.cominternal | In scope | 2026-11-14 |
| dev-my.gsam.comdev | In scope | 2026-11-14 |
| docreview.gsam.com | In scope | 2026-11-14 |
| www.docreview.gsam.com | In scope | 2026-11-14 |
| drm.gsam.com | In scope | 2026-11-14 |
| drm-qa.gsam.comtest | In scope | 2026-11-14 |
| fiai.gsam.com | In scope | 2026-11-14 |
| go.gsam.com | In scope | 2026-11-14 |
| internal.gsam.cominternal | In scope | 2026-11-14 |
| internal-qa.gsam.cominternal, test | In scope | 2026-11-14 |
| intranet.gsam.cominternal | In scope | 2026-11-14 |
| ldituner.gsam.com | In scope | 2026-11-14 |
| login.gsam.comauth | In scope | 2026-11-14 |
| login-qa.gsam.comauth, test | In scope | 2026-11-14 |
| marketing.gsam.com | In scope | 2026-11-14 |
| qa.marketing.gsam.comtest | In scope | 2026-11-14 |
| mijnpensioen.gsam.com | In scope | 2026-11-14 |
| my.gsam.com | In scope | 2026-11-14 |
| orgin-allvue.gsam.com | In scope | 2026-11-14 |
| origin.gsam.com | In scope | 2026-11-14 |
| origin-allvue.gsam.com | In scope | 2026-11-14 |
| patrimonial.gsam.com | In scope | 2026-11-14 |
| prod.gsam.com | In scope | 2026-11-14 |
| qa.gsam.comtest | In scope | 2026-11-14 |
| qa-my.gsam.comtest | In scope | 2026-11-14 |
| intranet.qa.gsam.cominternal, test | In scope | 2026-11-14 |
| sso.qa.gsam.comauth, test | In scope | 2026-11-14 |
| video.qa.gsam.comtest | In scope | 2026-11-14 |
| videos.qa.gsam.comtest | In scope | 2026-11-14 |
| qawebid.gsam.com | In scope | 2026-11-14 |
| qawebid2.gsam.com | In scope | 2026-11-14 |
| s.gsam.com | In scope | 2026-11-14 |
| www.s.gsam.com | In scope | 2026-11-14 |
| qa.sma.gsam.comtest | In scope | 2026-11-14 |
| sso.gsam.comauth | In scope | 2026-11-14 |
| thematic.gsam.com | In scope | 2026-11-14 |
| 33e29758de884da3ac1055a562a0ab03.thematic.gsam.com | In scope | 2026-11-14 |
| tracking.gsam.com | In scope | 2026-11-14 |
| qa.tracking.gsam.comtest | In scope | 2026-11-14 |
| uat.gsam.comtest | In scope | 2026-11-14 |
| uat-my.gsam.comtest | In scope | 2026-11-14 |
| docreview.uat.gsam.comtest | In scope | 2026-11-14 |
| subdocreview.uat.gsam.comtest | In scope | 2026-11-14 |
| video.gsam.com | In scope | 2026-11-14 |
| videos.gsam.com | In scope | 2026-11-14 |
| portal-webid-int.web.gsam.com | In scope | 2026-11-14 |
| webid.gsam.com | In scope | 2026-11-14 |
| webid2.gsam.com | In scope | 2026-11-14 |
| wg-mijnpensioen.gsam.com | In scope | 2026-11-14 |
| wn-mijnpensioen.gsam.com | In scope | 2026-11-14 |
| www.gsam.com | In scope | 2026-11-14 |
| wwwqa.gsam.com | In scope | 2026-11-14 |
4,394 names are covered by the program's own scope; 8 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.