Skip to content
Connect AISign inSign up free

Bug bounty program

RO

Roblox

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
5
Subdomains
2,245

Most upvoted reports5

Most upvoted reports of Roblox
ReportWeaknessDisclosedBountyVotes
Subdomain Takeover to Authentication bypassAnalysed#335330No weakness recorded2020-04-23–783
Insecure redirect rule results in bypassing ban redirect on certain pagesAnalysed#703058Insecure Direct Object Reference2020-04-26–233
Subdomain Takeover at creatorforum.roblox.comAnalysed#264494Access Control2020-03-24–90
Reflected XSS through multiple inputs in the issue collector on JiraAnalysed#380354Cross-site Scripting2020-03-24–56
Malformed string sent through FireServer leads to server freezing/hangingAnalysed#679907Denial of Service2020-04-29–44

Subdomains2,245

Root
Scope
Name suggests
First seen
Text file2,245 names
Subdomains of Roblox
NameScopeFirst seen
mosaic-proxy-grpc.rbx.comapiIn scope2026-11-14
mosaic-proxy-stage.rbx.comstagingIn scope2026-11-14
mosaic-proxy-stage-grpc.rbx.comapi, stagingIn scope2026-11-14
mrrouter-em-stage.rbx.comstagingIn scope2026-11-14
mrrouter-env-manager.rbx.comadminIn scope2026-11-14
dev.mrrouter-env-manager.rbx.comadmin, devIn scope2026-11-14
grpc.dev.mrrouter-env-manager.rbx.comadmin, api, devIn scope2026-11-14
grpc.mrrouter-env-manager.rbx.comadmin, apiIn scope2026-11-14
stage.mrrouter-env-manager.rbx.comadmin, stagingIn scope2026-11-14
grpc.stage.mrrouter-env-manager.rbx.comadmin, api, stagingIn scope2026-11-14
munki.rbx.comIn scope2026-11-14
rover.na.rbx.comIn scope2026-11-14
nascar.rbx.comIn scope2026-11-14
nascar-internal-lb.rbx.cominternalIn scope2026-11-14
nlord-barista-sandbox.rbx.comtestIn scope2026-11-14
nlord-test.rbx.comtestIn scope2026-11-14
nlp.rbx.comIn scope2026-11-14
nomad-demo.rbx.comtestIn scope2026-11-14
nomad-dev2.rbx.comdevIn scope2026-11-14
nomad-stage.rbx.comstagingIn scope2026-11-14
o11y-node.rbx.comIn scope2026-11-14
o11y-node-stage.rbx.comstagingIn scope2026-11-14
grpc.o11y-node.rbx.comapiIn scope2026-11-14
o11y-vm-drain.rbx.comIn scope2026-11-14
o11y-vm-drain-stage.rbx.comstagingIn scope2026-11-14
office.rbx.comIn scope2026-11-14
office-dev.rbx.comdevIn scope2026-11-14
office-stg.rbx.comstagingIn scope2026-11-14
old-legacy-url.rbx.comlegacyIn scope2026-11-14
orwell.rbx.comIn scope2026-11-14
oss-codecov.rbx.comIn scope2026-11-14
test.oss-codecov.rbx.comtestIn scope2026-11-14
p4-art.rbx.comIn scope2026-11-14
www.p4-art.rbx.comIn scope2026-11-14
paas-dsl-editor.rbx.comIn scope2026-11-14
pci.rbx.comIn scope2026-11-14
pidgeotto.rbx.comIn scope2026-11-14
pidgeotto-dev.rbx.comdevIn scope2026-11-14
pidgeotto-development.rbx.comdevIn scope2026-11-14
pidgeotto-prd.rbx.comIn scope2026-11-14
pidgeotto-production.rbx.comIn scope2026-11-14
pidgeotto-staging.rbx.comstagingIn scope2026-11-14
pidgeotto-stg.rbx.comstagingIn scope2026-11-14
dev.pidgeotto.rbx.comdevIn scope2026-11-14
grpc.dev.pidgeotto.rbx.comapi, devIn scope2026-11-14
grpc.pidgeotto.rbx.comapiIn scope2026-11-14
stage.pidgeotto.rbx.comstagingIn scope2026-11-14
grpc.stage.pidgeotto.rbx.comapi, stagingIn scope2026-11-14
corp.trust-dev.pki.rbx.comdev, internalIn scope2026-11-14
prod.trust-dev.pki.rbx.comdevIn scope2026-11-14
production.trust-dev.pki.rbx.comdevIn scope2026-11-14
sitetest1.trust-dev.pki.rbx.comdevIn scope2026-11-14
sitetest1-snc2.trust-dev.pki.rbx.comdevIn scope2026-11-14
sitetest1-snc3.trust-dev.pki.rbx.comdevIn scope2026-11-14
sitetest2.trust-dev.pki.rbx.comdevIn scope2026-11-14
sitetest2-snc2.trust-dev.pki.rbx.comdevIn scope2026-11-14
sitetest3.trust-dev.pki.rbx.comdevIn scope2026-11-14
corp.trust.pki.rbx.cominternalIn scope2026-11-14
prod.trust.pki.rbx.comIn scope2026-11-14
production.trust.pki.rbx.comIn scope2026-11-14
sitetest1.trust.pki.rbx.comIn scope2026-11-14
sitetest1-snc2.trust.pki.rbx.comIn scope2026-11-14
sitetest1-snc3.trust.pki.rbx.comIn scope2026-11-14
sitetest2.trust.pki.rbx.comIn scope2026-11-14
sitetest2-snc2.trust.pki.rbx.comIn scope2026-11-14
sitetest3.trust.pki.rbx.comIn scope2026-11-14
platform-dashboards.rbx.comIn scope2026-11-14
platform-pulse.rbx.comIn scope2026-11-14
pms.rbx.comIn scope2026-11-14
portal.rbx.comIn scope2026-11-14
portal-beta.rbx.comstagingIn scope2026-11-14
postgres-http-gateway.rbx.comdataIn scope2026-11-14
postgres-http-gateway-stage.rbx.comdata, stagingIn scope2026-11-14
posts-tools.rbx.comIn scope2026-11-14
powerhouse.rbx.comIn scope2026-11-14
preflight.rbx.comIn scope2026-11-14
rozilla.prod.rbx.comIn scope2026-11-14
rozilla-ash.prod.rbx.comIn scope2026-11-14
rozilla-chi.prod.rbx.comIn scope2026-11-14
sentry.prod.rbx.commonitoringIn scope2026-11-14
public.rbx.comIn scope2026-11-14
wildcard.public.rbx.comIn scope2026-11-14
pveinfluxdb.rbx.comIn scope2026-11-14
pveinfluxdb-stage.rbx.comstagingIn scope2026-11-14
questions.rbx.comIn scope2026-11-14
www.questions.rbx.comIn scope2026-11-14
rap.rbx.comIn scope2026-11-14
rcity.rbx.comIn scope2026-11-14
redirector.rbx.comIn scope2026-11-14
rekor.rbx.comIn scope2026-11-14
rekor-stage.rbx.comstagingIn scope2026-11-14
repo-config.rbx.comgitIn scope2026-11-14
repo-config-stage.rbx.comgit, stagingIn scope2026-11-14
repoconfig.rbx.comIn scope2026-11-14
repoconfig-stage.rbx.comstagingIn scope2026-11-14
report.rbx.comIn scope2026-11-14
report-proxy-test.rbx.comtestIn scope2026-11-14
research-dev.rbx.comdevIn scope2026-11-14
dev-druid.rocube.rbx.comdevIn scope2026-11-14
prod-druid.rocube.rbx.comIn scope2026-11-14

2,245 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated