Skip to content
Connect AISign inSign up free

Bug bounty program

RO

Roblox

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
5
Subdomains
2,245

Most upvoted reports5

Most upvoted reports of Roblox
ReportWeaknessDisclosedBountyVotes
Subdomain Takeover to Authentication bypassAnalysed#335330No weakness recorded2020-04-23–783
Insecure redirect rule results in bypassing ban redirect on certain pagesAnalysed#703058Insecure Direct Object Reference2020-04-26–233
Subdomain Takeover at creatorforum.roblox.comAnalysed#264494Access Control2020-03-24–90
Reflected XSS through multiple inputs in the issue collector on JiraAnalysed#380354Cross-site Scripting2020-03-24–56
Malformed string sent through FireServer leads to server freezing/hangingAnalysed#679907Denial of Service2020-04-29–44

Subdomains2,245

Root
Scope
Name suggests
First seen
Text file2,245 names
Subdomains of Roblox
NameScopeFirst seen
fm.rbx.comIn scope2026-11-14
fm-luobu-stage.rbx.comstagingIn scope2026-11-14
fm-luobu-test.rbx.comtestIn scope2026-11-14
fm-luobustage.rbx.comIn scope2026-11-14
fm-luobutest.rbx.comIn scope2026-11-14
fm-stage.rbx.comstagingIn scope2026-11-14
fmc-stage.rbx.comstagingIn scope2026-11-14
dev.follower.rbx.comdevIn scope2026-11-14
grpc.dev.follower.rbx.comapi, devIn scope2026-11-14
stage.follower.rbx.comstagingIn scope2026-11-14
grpc.stage.follower.rbx.comapi, stagingIn scope2026-11-14
forensics.rbx.comIn scope2026-11-14
forge-uw1.rbx.comIn scope2026-11-14
forge-uw2.rbx.comIn scope2026-11-14
forms.rbx.comIn scope2026-11-14
fossa.rbx.comIn scope2026-11-14
fossa-dev.rbx.comdevIn scope2026-11-14
fossa-ghc.rbx.comIn scope2026-11-14
fossa-old.rbx.comlegacyIn scope2026-11-14
fossa-stage.rbx.comstagingIn scope2026-11-14
fossa-temp.rbx.comIn scope2026-11-14
fulcio.rbx.comIn scope2026-11-14
fulcio-stage.rbx.comstagingIn scope2026-11-14
gdrive-scanner.rbx.comIn scope2026-11-14
gh-relay.rbx.comIn scope2026-11-14
gh-relay-stage.rbx.comstagingIn scope2026-11-14
gha-egress.rbx.comIn scope2026-11-14
gha-egress-ghc.rbx.comIn scope2026-11-14
gha-egress-ghc-stage.rbx.comstagingIn scope2026-11-14
gha-egress-stage.rbx.comstagingIn scope2026-11-14
gha-scaling.rbx.comIn scope2026-11-14
gha-scaling-stage.rbx.comstagingIn scope2026-11-14
ghaas-test-url.rbx.comtestIn scope2026-11-14
gharas-prod.rbx.comIn scope2026-11-14
gharas-stage.rbx.comstagingIn scope2026-11-14
ghe-stage1-new.rbx.comstagingIn scope2026-11-14
wildcard.ghe-stage1-new.rbx.comstagingIn scope2026-11-14
ghesst.rbx.comIn scope2026-11-14
github.rbx.comgitIn scope2026-11-14
github-cli-stage.rbx.comgit, stagingIn scope2026-11-14
wildcard.github-cli-stage.rbx.comgit, stagingIn scope2026-11-14
github-dev.rbx.comdev, gitIn scope2026-11-14
github-dev-dr.rbx.comdev, gitIn scope2026-11-14
github-flow.rbx.comgitIn scope2026-11-14
github-old.rbx.comgit, legacyIn scope2026-11-14
github-prod1.rbx.comgitIn scope2026-11-14
wildcard.github-prod1.rbx.comgitIn scope2026-11-14
github-stage.rbx.comgit, stagingIn scope2026-11-14
github-stage1.rbx.comgit, stagingIn scope2026-11-14
wildcard.github-stage1.rbx.comgit, stagingIn scope2026-11-14
github-test.rbx.comgit, testIn scope2026-11-14
12.github.rbx.comgitIn scope2026-11-14
15.github.rbx.comgitIn scope2026-11-14
2011.github.rbx.comgitIn scope2026-11-14
2012.github.rbx.comgitIn scope2026-11-14
9.github.rbx.comgitIn scope2026-11-14
a.github.rbx.comgitIn scope2026-11-14
admin.github.rbx.comadmin, gitIn scope2026-11-14
api1.github.rbx.comapi, gitIn scope2026-11-14
beta.github.rbx.comgit, stagingIn scope2026-11-14
brand.github.rbx.comgitIn scope2026-11-14
cs.github.rbx.comgitIn scope2026-11-14
demo.github.rbx.comgit, testIn scope2026-11-14
dev.github.rbx.comdev, gitIn scope2026-11-14
di.github.rbx.comgitIn scope2026-11-14
drop.github.rbx.comgitIn scope2026-11-14
euwe.github.rbx.comgitIn scope2026-11-14
evelynn.github.rbx.comgitIn scope2026-11-14
frontpage.github.rbx.comgitIn scope2026-11-14
hkg.github.rbx.comgitIn scope2026-11-14
hwcdn.github.rbx.comgitIn scope2026-11-14
jenkins.github.rbx.comci, gitIn scope2026-11-14
jinx.github.rbx.comgitIn scope2026-11-14
jira.github.rbx.comgit, toolsIn scope2026-11-14
kor.github.rbx.comgitIn scope2026-11-14
merch.github.rbx.comgitIn scope2026-11-14
ml.github.rbx.comgitIn scope2026-11-14
kubeflow.ml.github.rbx.comgitIn scope2026-11-14
moderation.github.rbx.comgitIn scope2026-11-14
nautilus.github.rbx.comgitIn scope2026-11-14
pl.github.rbx.comgitIn scope2026-11-14
promotion.github.rbx.comgitIn scope2026-11-14
rbx.github.rbx.comgitIn scope2026-11-14
singed.github.rbx.comgitIn scope2026-11-14
skins.github.rbx.comgitIn scope2026-11-14
test.github.rbx.comgit, testIn scope2026-11-14
tur.github.rbx.comgitIn scope2026-11-14
vpn.github.rbx.comgit, vpnIn scope2026-11-14
webmail.github.rbx.comgit, mailIn scope2026-11-14
wildcard.github.rbx.comgitIn scope2026-11-14
gpu-viz.rbx.comIn scope2026-11-14
grafana.rbx.commonitoringIn scope2026-11-14
grafana-ee-stage.rbx.commonitoring, stagingIn scope2026-11-14
grafana-stage.rbx.commonitoring, stagingIn scope2026-11-14
growth-acquisition-key-art.rbx.comIn scope2026-11-14
growthbook.rbx.comIn scope2026-11-14
growthbook-api-dev.rbx.comapi, devIn scope2026-11-14
growthbook-dev.rbx.comdevIn scope2026-11-14
guard-frontend.rbx.comIn scope2026-11-14
hazmat-api.rbx.comapiIn scope2026-11-14

2,245 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated