Skip to content
Connect AISign inSign up free

Bug bounty program

RO

Roblox

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
5
Subdomains
2,245

Most upvoted reports5

Most upvoted reports of Roblox
ReportWeaknessDisclosedBountyVotes
Subdomain Takeover to Authentication bypassAnalysed#335330No weakness recorded2020-04-23–783
Insecure redirect rule results in bypassing ban redirect on certain pagesAnalysed#703058Insecure Direct Object Reference2020-04-26–233
Subdomain Takeover at creatorforum.roblox.comAnalysed#264494Access Control2020-03-24–90
Reflected XSS through multiple inputs in the issue collector on JiraAnalysed#380354Cross-site Scripting2020-03-24–56
Malformed string sent through FireServer leads to server freezing/hangingAnalysed#679907Denial of Service2020-04-29–44

Subdomains2,245

Root
Scope
Name suggests
First seen
Text file2,245 names
Subdomains of Roblox
NameScopeFirst seen
devspaces-egress-dpi-stage.rbx.comstagingIn scope2026-11-14
devspaces-egress-stage.rbx.comstagingIn scope2026-11-14
devspaces-stage.rbx.comstagingIn scope2026-11-14
wildcard.devspaces.rbx.comIn scope2026-11-14
devspaces2.rbx.comIn scope2026-11-14
devspaces2-stage.rbx.comstagingIn scope2026-11-14
airflow.di.rbx.comtoolsIn scope2026-11-14
airflow2.di.rbx.comtoolsIn scope2026-11-14
core.airflow2.di.rbx.comtoolsIn scope2026-11-14
wildcard.core.airflow2.di.rbx.comtoolsIn scope2026-11-14
data-platform.airflow2.di.rbx.comtoolsIn scope2026-11-14
wildcard.data-platform.airflow2.di.rbx.comtoolsIn scope2026-11-14
wildcard.airflow2.di.rbx.comtoolsIn scope2026-11-14
amundsen.di.rbx.comIn scope2026-11-14
amundsen-dev.di.rbx.comdevIn scope2026-11-14
amundsen-es-dev.di.rbx.comdevIn scope2026-11-14
amundsen-es-test.di.rbx.comtestIn scope2026-11-14
amundsen-neo4j-dev.di.rbx.comdevIn scope2026-11-14
amundsen-neo4j-test.di.rbx.comtestIn scope2026-11-14
amundsen-test.di.rbx.comtestIn scope2026-11-14
astro-dev.di.rbx.comdevIn scope2026-11-14
alertmanager.astro-dev.di.rbx.comdev, monitoringIn scope2026-11-14
app.astro-dev.di.rbx.comdevIn scope2026-11-14
deployments.astro-dev.di.rbx.comdevIn scope2026-11-14
grafana.astro-dev.di.rbx.comdev, monitoringIn scope2026-11-14
houston.astro-dev.di.rbx.comdevIn scope2026-11-14
install.astro-dev.di.rbx.comdevIn scope2026-11-14
kibana.astro-dev.di.rbx.comdev, monitoringIn scope2026-11-14
prometheus.astro-dev.di.rbx.comdev, monitoringIn scope2026-11-14
registry.astro-dev.di.rbx.comdev, toolsIn scope2026-11-14
astro-prod.di.rbx.comIn scope2026-11-14
dc-alpha.di.rbx.comstagingIn scope2026-11-14
dev-druid-ash1-monitor.di.rbx.comdev, monitoringIn scope2026-11-14
dev-druid-ash1-pivot.di.rbx.comdevIn scope2026-11-14
dev-druid-ash1-router.di.rbx.comdevIn scope2026-11-14
dev-druid-dc-1.di.rbx.comdevIn scope2026-11-14
dev-growth-dc-1.di.rbx.comdevIn scope2026-11-14
dev-kubeflow-dc-1.di.rbx.comdevIn scope2026-11-14
dev-trinodb-dc-1.di.rbx.comdevIn scope2026-11-14
dispatcher.di.rbx.comIn scope2026-11-14
druid-test.di.rbx.comtestIn scope2026-11-14
druid-test2.di.rbx.comtestIn scope2026-11-14
game.di.rbx.comIn scope2026-11-14
hive.di.rbx.comIn scope2026-11-14
hive-prod.di.rbx.comIn scope2026-11-14
hive-test.di.rbx.comtestIn scope2026-11-14
imply-prod.di.rbx.comIn scope2026-11-14
kon-airflow-dev.di.rbx.comdev, toolsIn scope2026-11-14
kon-trinodb.di.rbx.comIn scope2026-11-14
prod-trinodb-dc-1.di.rbx.comIn scope2026-11-14
ranger.di.rbx.comIn scope2026-11-14
rke-server-alpha.di.rbx.comstagingIn scope2026-11-14
rke-server-test.di.rbx.comtestIn scope2026-11-14
rke2-ray-test.di.rbx.comtestIn scope2026-11-14
rke2-server-alpha1.di.rbx.comstagingIn scope2026-11-14
rke2-server-alpha2.di.rbx.comstagingIn scope2026-11-14
rstudio.di.rbx.comIn scope2026-11-14
rstudio-test.di.rbx.comtestIn scope2026-11-14
spark-k8s.di.rbx.comtoolsIn scope2026-11-14
ash1-rke-alpha.spark-k8s.di.rbx.comstaging, toolsIn scope2026-11-14
starburst-airflow-blue.di.rbx.comtoolsIn scope2026-11-14
starburst-blue.di.rbx.comIn scope2026-11-14
starburst-green.di.rbx.comIn scope2026-11-14
starburst-presto-alpha.di.rbx.comstagingIn scope2026-11-14
starburst-presto-prod.di.rbx.comIn scope2026-11-14
starburst-presto-test.di.rbx.comtestIn scope2026-11-14
starburst-trino-etl.di.rbx.comIn scope2026-11-14
starburst-trino-notebook.di.rbx.comIn scope2026-11-14
starburst-trino-superset.di.rbx.comtoolsIn scope2026-11-14
superset.di.rbx.comtoolsIn scope2026-11-14
superset-dev.di.rbx.comdev, toolsIn scope2026-11-14
superset-staging.di.rbx.comstaging, toolsIn scope2026-11-14
superset-test.di.rbx.comtest, toolsIn scope2026-11-14
trino-adhoc.di.rbx.comIn scope2026-11-14
trino-adhoc-blue.di.rbx.comIn scope2026-11-14
trino-adhoc-green.di.rbx.comIn scope2026-11-14
trino-airflowdev-os-blue.di.rbx.comIn scope2026-11-14
trino-airflowprod-os-blue.di.rbx.comIn scope2026-11-14
trino-airflowprod-os-green.di.rbx.comIn scope2026-11-14
trino-opensource-blue.di.rbx.comIn scope2026-11-14
trino-opensource-green.di.rbx.comIn scope2026-11-14
trino-privacera.di.rbx.comIn scope2026-11-14
trino-starburst-blue.di.rbx.comIn scope2026-11-14
trino-starburst-green.di.rbx.comIn scope2026-11-14
trino-superset.di.rbx.comtoolsIn scope2026-11-14
trino-superset-os-blue.di.rbx.comtoolsIn scope2026-11-14
trino-superset-os-green.di.rbx.comtoolsIn scope2026-11-14
trino-superset-prod.di.rbx.comtoolsIn scope2026-11-14
trino-superset-sb-blue.di.rbx.comtoolsIn scope2026-11-14
trino-superset-sb-green.di.rbx.comtoolsIn scope2026-11-14
trinodb-dc-airflow-dev.di.rbx.comdev, toolsIn scope2026-11-14
trinodb-dc-airflow-dev-ash1.di.rbx.comdev, toolsIn scope2026-11-14
trinodb-dc-airflow-prod.di.rbx.comtoolsIn scope2026-11-14
trinodb-dc-airflow-prod-ash1.di.rbx.comtoolsIn scope2026-11-14
trinodb-prod.di.rbx.comIn scope2026-11-14
trinodb-prod-dc.di.rbx.comIn scope2026-11-14
dic.rbx.comIn scope2026-11-14
astro-openid-discovery.dic.rbx.comIn scope2026-11-14
airflow2.dev-core.dic.rbx.comdev, toolsIn scope2026-11-14
astro.dev-core.dic.rbx.comdevIn scope2026-11-14

2,245 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated