Skip to content
Connect AISign inSign up free

Bug bounty program

RO

Roblox

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
5
Subdomains
2,245

Most upvoted reports5

Most upvoted reports of Roblox
ReportWeaknessDisclosedBountyVotes
Subdomain Takeover to Authentication bypassAnalysed#335330No weakness recorded2020-04-23–783
Insecure redirect rule results in bypassing ban redirect on certain pagesAnalysed#703058Insecure Direct Object Reference2020-04-26–233
Subdomain Takeover at creatorforum.roblox.comAnalysed#264494Access Control2020-03-24–90
Reflected XSS through multiple inputs in the issue collector on JiraAnalysed#380354Cross-site Scripting2020-03-24–56
Malformed string sent through FireServer leads to server freezing/hangingAnalysed#679907Denial of Service2020-04-29–44

Subdomains2,245

Root
Scope
Name suggests
First seen
Text file2,245 names
Subdomains of Roblox
NameScopeFirst seen
artifactory-edgetest.rbx.comtoolsIn scope2026-11-14
artifactory-prod-aa.rbx.comtoolsIn scope2026-11-14
artifactory-prod-test.rbx.comtest, toolsIn scope2026-11-14
artifactory-prod1.rbx.comtoolsIn scope2026-11-14
wildcard.artifactory-prod1.rbx.comtoolsIn scope2026-11-14
artifactory-stage.rbx.comstaging, toolsIn scope2026-11-14
artifactory-stage-aa.rbx.comstaging, toolsIn scope2026-11-14
artifactory-stage-aa-test.rbx.comstaging, test, toolsIn scope2026-11-14
artifactory-stage-old.rbx.comlegacy, staging, toolsIn scope2026-11-14
wildcard.artifactory-stage-old.rbx.comlegacy, staging, toolsIn scope2026-11-14
artifactory-stage2.rbx.comstaging, toolsIn scope2026-11-14
artifactory-stage7.rbx.comstaging, toolsIn scope2026-11-14
wildcard.artifactory-stage7.rbx.comstaging, toolsIn scope2026-11-14
artifactory-test.rbx.comtest, toolsIn scope2026-11-14
artifactory-uswest1.rbx.comtoolsIn scope2026-11-14
wildcard.artifactory.rbx.comtoolsIn scope2026-11-14
artifacts.rbx.comIn scope2026-11-14
artifacts-api.rbx.comapiIn scope2026-11-14
artifacts-api-stage.rbx.comapi, stagingIn scope2026-11-14
artifacts-prod-1.rbx.comIn scope2026-11-14
wildcard.artifacts-prod-1.rbx.comIn scope2026-11-14
artifacts-stage.rbx.comstagingIn scope2026-11-14
artifacts-stage-1.rbx.comstagingIn scope2026-11-14
wildcard.artifacts-stage-1.rbx.comstagingIn scope2026-11-14
wildcard.artifacts-stage.rbx.comstagingIn scope2026-11-14
wildcard.artifacts.rbx.comIn scope2026-11-14
askinfosec.rbx.comIn scope2026-11-14
aul.rbx.comIn scope2026-11-14
autodiscover.rbx.commailIn scope2026-11-14
aws-ap-east-1a-lms.rbx.comIn scope2026-11-14
aws-ap-east-1b-lms.rbx.comIn scope2026-11-14
aws-ap-east-1c-lms.rbx.comIn scope2026-11-14
aws-ap-northeast-1a-lms.rbx.comIn scope2026-11-14
aws-ap-northeast-1c-lms.rbx.comIn scope2026-11-14
aws-ap-northeast-1d-lms.rbx.comIn scope2026-11-14
aws-eu-central-1a-lms.rbx.comIn scope2026-11-14
aws-eu-central-1b-lms.rbx.comIn scope2026-11-14
aws-eu-central-1c-lms.rbx.comIn scope2026-11-14
aws-eu-west-2a-lms.rbx.comIn scope2026-11-14
aws-eu-west-2b-lms.rbx.comIn scope2026-11-14
aws-eu-west-2c-lms.rbx.comIn scope2026-11-14
svc.scep01.ra-scep.pki.aws-prod.rbx.comIn scope2026-11-14
svc.scep02.ra-scep.pki.aws-prod.rbx.comIn scope2026-11-14
svc.scep03.ra-scep.pki.aws-stage.rbx.comstagingIn scope2026-11-14
svc.iap.aws-test.rbx.comtestIn scope2026-11-14
svc.scep01.ra-scep.pki.aws-test.rbx.comtestIn scope2026-11-14
svc.scep03.ra-scep.pki.aws-test.rbx.comtestIn scope2026-11-14
aws-us-east-1a-lms.rbx.comIn scope2026-11-14
aws-us-east-1b-lms.rbx.comIn scope2026-11-14
aws-us-east-1c-lms.rbx.comIn scope2026-11-14
aws-us-east-2a-lms.rbx.comIn scope2026-11-14
aws-us-east-2b-lms.rbx.comIn scope2026-11-14
aws-us-east-2c-lms.rbx.comIn scope2026-11-14
aws-us-west-1a-lms.rbx.comIn scope2026-11-14
aws-us-west-1c-lms.rbx.comIn scope2026-11-14
aws-us-west-2a-lms.rbx.comIn scope2026-11-14
aws-us-west-2b-lms.rbx.comIn scope2026-11-14
aws-us-west-2c-lms.rbx.comIn scope2026-11-14
azdo.rbx.comIn scope2026-11-14
www.azdo.rbx.comIn scope2026-11-14
backtrace-console-eeri.rbx.comadminIn scope2026-11-14
backtrace-crashes-eeri.rbx.comIn scope2026-11-14
backtrace-stage.rbx.comstagingIn scope2026-11-14
console.backtrace.rbx.comadminIn scope2026-11-14
console-stage.backtrace.rbx.comadmin, stagingIn scope2026-11-14
crashes.backtrace.rbx.comIn scope2026-11-14
crashes-stage.backtrace.rbx.comstagingIn scope2026-11-14
uploads.backtrace.rbx.comdataIn scope2026-11-14
uploads-stage.backtrace.rbx.comdata, stagingIn scope2026-11-14
bloxid.rbx.comIn scope2026-11-14
bloxvisualizer.rbx.comIn scope2026-11-14
bpo-ao-vpn.rbx.comvpnIn scope2026-11-14
www.bpo-ao-vpn.rbx.comvpnIn scope2026-11-14
bpo-governance-ui.rbx.comIn scope2026-11-14
bpo-vpn.rbx.comvpnIn scope2026-11-14
hkg-full-gw.bpo-vpn.rbx.comvpnIn scope2026-11-14
hkg-gw.bpo-vpn.rbx.comvpnIn scope2026-11-14
iad-full-gw.bpo-vpn.rbx.comvpnIn scope2026-11-14
iad-gw.bpo-vpn.rbx.comvpnIn scope2026-11-14
nrt-full-gw.bpo-vpn.rbx.comvpnIn scope2026-11-14
nrt-gw.bpo-vpn.rbx.comvpnIn scope2026-11-14
sin-full-gw.bpo-vpn.rbx.comvpnIn scope2026-11-14
sin-gw.bpo-vpn.rbx.comvpnIn scope2026-11-14
www.bpo-vpn.rbx.comvpnIn scope2026-11-14
brand-studio.rbx.comIn scope2026-11-14
brand-tools.rbx.comIn scope2026-11-14
brands-demo.rbx.comtestIn scope2026-11-14
brands-dev.rbx.comdevIn scope2026-11-14
brands-stage.rbx.comstagingIn scope2026-11-14
build.rbx.comciIn scope2026-11-14
buildcharts.rbx.comIn scope2026-11-14
builderai.rbx.comIn scope2026-11-14
builderai-demo-cdn.rbx.comtestIn scope2026-11-14
builderci.rbx.comIn scope2026-11-14
builderci-api.rbx.comapiIn scope2026-11-14
c0a3052bbbc919f6.rbx.comIn scope2026-11-14
api.c0a3052bbbc919f6.rbx.comapiIn scope2026-11-14
cachet-stage.rbx.comstagingIn scope2026-11-14
careers-demo.rbx.comtestIn scope2026-11-14
careers-dev.rbx.comdevIn scope2026-11-14

2,245 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated