H1 HackerOne LIVE
Whoop Bug Bounty
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.whoop.com
- managed triage
- yes
- response efficiency
- 75%
- first response
- 22h avg
- time to bounty
- 572h avg
8 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
api.prod.whoop.com | domain | yes | critical | 2026-09-20 |
app.whoop.com | domain | yes | critical | 2026-09-20 |
shop.whoop.com | domain | yes | critical | 2026-09-20 |
com.whoop.android | mobile | yes | critical | 2026-09-20 |
com.whoop.iphone | mobile | yes | critical | 2026-09-20 |
WHOOP 4.0 STRAP | other | yes | critical | 2026-09-20 |
WHOOP 5.0/MG STRAP | other | yes | critical | 2026-09-20 |
join.whoop.com | other | yes | critical | 2026-09-20 |
4 out of scope — black ICE, don't touch
okta.whoop.comdomainAzure AD, Google Drive, Link Sharing WebsitesotherCredit/Debit Card TestingotherSupport Systemother
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.