Skip to content
Connect AISign inSign up free

Bug bounty program

RO

Roblox

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
5
Subdomains
2,245

Most upvoted reports5

Most upvoted reports of Roblox
ReportWeaknessDisclosedBountyVotes
Subdomain Takeover to Authentication bypassAnalysed#335330No weakness recorded2020-04-23–783
Insecure redirect rule results in bypassing ban redirect on certain pagesAnalysed#703058Insecure Direct Object Reference2020-04-26–233
Subdomain Takeover at creatorforum.roblox.comAnalysed#264494Access Control2020-03-24–90
Reflected XSS through multiple inputs in the issue collector on JiraAnalysed#380354Cross-site Scripting2020-03-24–56
Malformed string sent through FireServer leads to server freezing/hangingAnalysed#679907Denial of Service2020-04-29–44

Subdomains2,245

Root:roblox.com
Scope
Name suggests
First seen
Text fileClear filters692 names
Subdomains of Roblox
NameScopeFirst seen
about.roblox.comIn scope2026-11-14
abtesting.roblox.comIn scope2026-11-14
accountinformation.roblox.comIn scope2026-11-14
accountsettings.roblox.comIn scope2026-11-14
adconfiguration.roblox.comIn scope2026-11-14
ads.roblox.comIn scope2026-11-14
ads-library.roblox.comIn scope2026-11-14
advertise.roblox.comIn scope2026-11-14
affiliates.roblox.comIn scope2026-11-14
altdevforum.roblox.comIn scope2026-11-14
ams1-128-116-121-3.roblox.comIn scope2026-11-14
ams2-128-116-21-3.roblox.comIn scope2026-11-14
analytics.roblox.comIn scope2026-11-14
anticheat.roblox.comIn scope2026-11-14
api.roblox.comapiIn scope2026-11-14
billing.api.roblox.comapiIn scope2026-11-14
clientsettings.api.roblox.comapiIn scope2026-11-14
ephemeralcounters.api.roblox.comapiIn scope2026-11-14
ephemeralcounters-split.api.roblox.comapiIn scope2026-11-14
games.api.roblox.comapiIn scope2026-11-14
www.games.api.roblox.comapiIn scope2026-11-14
messagerouter.api.roblox.comapiIn scope2026-11-14
search.api.roblox.comapiIn scope2026-11-14
versioncompatibility.api.roblox.comapiIn scope2026-11-14
apis.roblox.comapiIn scope2026-11-14
appmail.roblox.comIn scope2026-11-14
aries-web.roblox.comIn scope2026-11-14
arkoselabs.roblox.comIn scope2026-11-14
ipv4.de-cix.nyc.us.as22697.roblox.comIn scope2026-11-14
ash1-128-116-114-3.roblox.comIn scope2026-11-14
assetdelivery.roblox.comIn scope2026-11-14
assetdelivery-split.roblox.comIn scope2026-11-14
assetgame.roblox.comIn scope2026-11-14
atl1-128-116-99-3.roblox.comIn scope2026-11-14
auth.roblox.comauthIn scope2026-11-14
authorize.roblox.comIn scope2026-11-14
authsite.roblox.comIn scope2026-11-14
avatar.roblox.comIn scope2026-11-14
avatarsite.roblox.comIn scope2026-11-14
awsvpn.roblox.comIn scope2026-11-14
badges.roblox.comIn scope2026-11-14
barista.roblox.comIn scope2026-11-14
barista-example.roblox.comIn scope2026-11-14
billing.roblox.comIn scope2026-11-14
blahblahblahblah.roblox.comIn scope2026-11-14
blog.roblox.comIn scope2026-11-14
blog-origin.roblox.comIn scope2026-11-14
dosarrest.rp-web6.blog.roblox.comIn scope2026-11-14
dosarrest.rp-web9.blog.roblox.comIn scope2026-11-14
sandbox.blog.roblox.comtestIn scope2026-11-14
blogs.roblox.comIn scope2026-11-14
bloxcon.roblox.comIn scope2026-11-14
bom1-128-116-104-3.roblox.comIn scope2026-11-14
bom1-128-116-104-4.roblox.comIn scope2026-11-14
br1-sea1.roblox.comIn scope2026-11-14
de-cix.br1.roblox.comIn scope2026-11-14
br2-sea1.roblox.comIn scope2026-11-14
de-cix.br2.roblox.comIn scope2026-11-14
brands.roblox.comIn scope2026-11-14
bronze.roblox.comIn scope2026-11-14
c0.roblox.comIn scope2026-11-14
c0ak.roblox.comIn scope2026-11-14
c1.roblox.comIn scope2026-11-14
c1ak.roblox.comIn scope2026-11-14
c2.roblox.comIn scope2026-11-14
c2-cf.roblox.comIn scope2026-11-14
c2ak.roblox.comIn scope2026-11-14
c3.roblox.comIn scope2026-11-14
c3-cf.roblox.comIn scope2026-11-14
c3ak.roblox.comIn scope2026-11-14
c4.roblox.comIn scope2026-11-14
c4ak.roblox.comIn scope2026-11-14
c5.roblox.comIn scope2026-11-14
c5ak.roblox.comIn scope2026-11-14
c6.roblox.comIn scope2026-11-14
c6-cf.roblox.comIn scope2026-11-14
c6ak.roblox.comIn scope2026-11-14
c7.roblox.comIn scope2026-11-14
c7-cf.roblox.comIn scope2026-11-14
c7ak.roblox.comIn scope2026-11-14
c7bg.roblox.comIn scope2026-11-14
captcha.roblox.comIn scope2026-11-14
career.roblox.comIn scope2026-11-14
careers.roblox.comIn scope2026-11-14
www.careers.roblox.comIn scope2026-11-14
cas-admin.roblox.comadmin, authIn scope2026-11-14
catalog.roblox.comIn scope2026-11-14
cdg1-128-116-122-3.roblox.comIn scope2026-11-14
cdnproviders.roblox.comIn scope2026-11-14
chat.roblox.comIn scope2026-11-14
chatmoderation.roblox.comIn scope2026-11-14
chatsite.roblox.comIn scope2026-11-14
chi1-128-116-112-44.roblox.comIn scope2026-11-14
chi1-origin.roblox.comIn scope2026-11-14
cilent.roblox.comIn scope2026-11-14
civility.roblox.comIn scope2026-11-14
client.roblox.comIn scope2026-11-14
client-assets.roblox.comIn scope2026-11-14
client-telemetry.roblox.comIn scope2026-11-14
cliente.roblox.comIn scope2026-11-14

2,245 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated