Skip to content
Connect AISign inSign up free

Bug bounty program

RO

Roblox

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
5
Subdomains
2,245

Most upvoted reports5

Most upvoted reports of Roblox
ReportWeaknessDisclosedBountyVotes
Subdomain Takeover to Authentication bypassAnalysed#335330No weakness recorded2020-04-23–783
Insecure redirect rule results in bypassing ban redirect on certain pagesAnalysed#703058Insecure Direct Object Reference2020-04-26–233
Subdomain Takeover at creatorforum.roblox.comAnalysed#264494Access Control2020-03-24–90
Reflected XSS through multiple inputs in the issue collector on JiraAnalysed#380354Cross-site Scripting2020-03-24–56
Malformed string sent through FireServer leads to server freezing/hangingAnalysed#679907Denial of Service2020-04-29–44

Subdomains2,245

Root
Scope
Name suggests
First seen
Text file2,245 names
Subdomains of Roblox
NameScopeFirst seen
dashboard.prod-druid.rocube.rbx.comadminIn scope2026-11-14
standby.prod-druid.rocube.rbx.comIn scope2026-11-14
test.prod-druid.rocube.rbx.comtestIn scope2026-11-14
sitetest-druid.rocube.rbx.comIn scope2026-11-14
dashboard.sitetest-druid.rocube.rbx.comadminIn scope2026-11-14
test.sitetest-druid.rocube.rbx.comtestIn scope2026-11-14
staging-druid.rocube.rbx.comstagingIn scope2026-11-14
rorunner.rbx.comIn scope2026-11-14
ros.rbx.comIn scope2026-11-14
ros-ai-chat-dev.rbx.comdevIn scope2026-11-14
ros-dev.rbx.comdevIn scope2026-11-14
api.ros-dev.rbx.comapi, devIn scope2026-11-14
apis.ros-dev.rbx.comapi, devIn scope2026-11-14
argocd.ros-dev.rbx.comci, devIn scope2026-11-14
camunda.ros-dev.rbx.comdevIn scope2026-11-14
effmeet.ros-dev.rbx.comdevIn scope2026-11-14
feedback.ros-dev.rbx.comdevIn scope2026-11-14
preview.ros-dev.rbx.comdev, stagingIn scope2026-11-14
ros-docs.rbx.comIn scope2026-11-14
ros-snap.rbx.comIn scope2026-11-14
api.ros-snap.rbx.comapiIn scope2026-11-14
apis.ros-snap.rbx.comapiIn scope2026-11-14
camunda.ros-snap.rbx.comIn scope2026-11-14
feedback.ros-snap.rbx.comIn scope2026-11-14
ros-stg.rbx.comstagingIn scope2026-11-14
api.ros-stg.rbx.comapi, stagingIn scope2026-11-14
apis.ros-stg.rbx.comapi, stagingIn scope2026-11-14
argocd.ros-stg.rbx.comci, stagingIn scope2026-11-14
camunda.ros-stg.rbx.comstagingIn scope2026-11-14
effmeet.ros-stg.rbx.comstagingIn scope2026-11-14
feedback.ros-stg.rbx.comstagingIn scope2026-11-14
airhooks.ros.rbx.comIn scope2026-11-14
api.ros.rbx.comapiIn scope2026-11-14
apis.ros.rbx.comapiIn scope2026-11-14
argocd.ros.rbx.comciIn scope2026-11-14
camunda.ros.rbx.comIn scope2026-11-14
effmeet.ros.rbx.comIn scope2026-11-14
feedback.ros.rbx.comIn scope2026-11-14
lc.ros.rbx.comIn scope2026-11-14
lc-comp.ros.rbx.comIn scope2026-11-14
lc-psa.ros.rbx.comIn scope2026-11-14
lc-sb.ros.rbx.comIn scope2026-11-14
lc-stg.ros.rbx.comstagingIn scope2026-11-14
n8n.ros.rbx.comIn scope2026-11-14
retool.ros.rbx.comIn scope2026-11-14
rosecportal.rbx.comIn scope2026-11-14
rosecportal-api.rbx.comapiIn scope2026-11-14
rosecportal-api-dev.rbx.comapi, devIn scope2026-11-14
rosecportal-dev.rbx.comdevIn scope2026-11-14
rosheet.rbx.comIn scope2026-11-14
roswebench.rbx.comIn scope2026-11-14
rotam.rbx.comIn scope2026-11-14
rotools.rbx.comIn scope2026-11-14
routehub.rbx.comIn scope2026-11-14
rozilla-stage.rbx.comstagingIn scope2026-11-14
rozilla-stx.rbx.comIn scope2026-11-14
scim.rbx.comIn scope2026-11-14
scim-bridge.rbx.comIn scope2026-11-14
www.scim-bridge.rbx.comIn scope2026-11-14
www.scim.rbx.comIn scope2026-11-14
scim1pass.rbx.comIn scope2026-11-14
security.rbx.comIn scope2026-11-14
security-hub.rbx.comIn scope2026-11-14
www.security.rbx.comIn scope2026-11-14
sentry-relay.rbx.commonitoringIn scope2026-11-14
service-catalog-aws.rbx.comIn scope2026-11-14
service-catalog-aws-stage.rbx.comstagingIn scope2026-11-14
service-desk-admin-portal.rbx.comadminIn scope2026-11-14
sg.rbx.comIn scope2026-11-14
o7.sg.rbx.comIn scope2026-11-14
sgmodule.rbx.comIn scope2026-11-14
shrike.rbx.comIn scope2026-11-14
shrike-stage.rbx.comstagingIn scope2026-11-14
sigstore-poc.rbx.comIn scope2026-11-14
wildcard.sigstore-poc.rbx.comIn scope2026-11-14
rozilla.sitetest.rbx.comIn scope2026-11-14
bloxid.sitetest1.rbx.comIn scope2026-11-14
webapps.sitetest1.rbx.comIn scope2026-11-14
bloxid.sitetest2.rbx.comIn scope2026-11-14
bloxid.sitetest3.rbx.comIn scope2026-11-14
integration.bloxid.sitetest3.rbx.comIn scope2026-11-14
webapps.sitetest3.rbx.comIn scope2026-11-14
wildcard.webapps.sitetest3.rbx.comIn scope2026-11-14
sjp-global-status.rbx.commonitoringIn scope2026-11-14
sjp-global-status-stage.rbx.commonitoring, stagingIn scope2026-11-14
sjp-operations-service-ash1.rbx.comIn scope2026-11-14
sjp-operations-service-chi1.rbx.comIn scope2026-11-14
sjp-operations-service-e000.rbx.comIn scope2026-11-14
sjp-operations-service-prod.rbx.comIn scope2026-11-14
sjp-operations-service-st1.rbx.comIn scope2026-11-14
sjp-operations-service-st1-snc2.rbx.comIn scope2026-11-14
sjp-operations-service-st1-snc3.rbx.comIn scope2026-11-14
sjp-operations-service-st2.rbx.comIn scope2026-11-14
sjp-operations-service-st2-snc2.rbx.comIn scope2026-11-14
sjp-operations-service-st3.rbx.comIn scope2026-11-14
sjp-pool-access-service-prod.rbx.comvpnIn scope2026-11-14
sjp-pool-access-service-st1.rbx.comvpnIn scope2026-11-14
sjp-regional-status-service-ash1.rbx.commonitoringIn scope2026-11-14
sjp-regional-status-service-chi1.rbx.commonitoringIn scope2026-11-14
sjp-regional-status-service-st1-snc2.rbx.commonitoringIn scope2026-11-14

2,245 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated