Bug bounty program
RO
Roblox
Most upvoted reports5
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Subdomain Takeover to Authentication bypassAnalysed#335330 | No weakness recorded | 2020-04-23 | – | 783 |
| Insecure redirect rule results in bypassing ban redirect on certain pagesAnalysed#703058 | Insecure Direct Object Reference | 2020-04-26 | – | 233 |
| Subdomain Takeover at creatorforum.roblox.comAnalysed#264494 | Access Control | 2020-03-24 | – | 90 |
| Reflected XSS through multiple inputs in the issue collector on JiraAnalysed#380354 | Cross-site Scripting | 2020-03-24 | – | 56 |
| Malformed string sent through FireServer leads to server freezing/hangingAnalysed#679907 | Denial of Service | 2020-04-29 | – | 44 |
Subdomains2,245
| Name | Scope | First seen |
|---|---|---|
| about-dev.rbx.comdev | In scope | 2026-11-14 |
| arti-ha-dev.rbx.comdev | In scope | 2026-11-14 |
| artifactory-dev.rbx.comdev, tools | In scope | 2026-11-14 |
| brands-dev.rbx.comdev | In scope | 2026-11-14 |
| careers-dev.rbx.comdev | In scope | 2026-11-14 |
| cdctl-dev.rbx.comdev | In scope | 2026-11-14 |
| cdctl-dev-poll.rbx.comdev | In scope | 2026-11-14 |
| cdctl-dev-poller.rbx.comdev | In scope | 2026-11-14 |
| cdctl-dev-tmp.rbx.comdev | In scope | 2026-11-14 |
| changestream-manager-dev.rbx.comadmin, dev | In scope | 2026-11-14 |
| changestream-manager-dev-grpc.rbx.comadmin, api, dev | In scope | 2026-11-14 |
| cms-dev.rbx.comadmin, dev | In scope | 2026-11-14 |
| codecov-dev.rbx.comdev | In scope | 2026-11-14 |
| confluence-dev.rbx.comdev, tools | In scope | 2026-11-14 |
| consul-dev2.rbx.comdev, tools | In scope | 2026-11-14 |
| dev.critr.rbx.comdev | In scope | 2026-11-14 |
| grpc.dev.critr.rbx.comapi, dev | In scope | 2026-11-14 |
| datahub-dev.rbx.comdev | In scope | 2026-11-14 |
| dev.rbx.comdev | In scope | 2026-11-14 |
| dev-confluence-dns-name.rbx.comdev, tools | In scope | 2026-11-14 |
| dev-docker-registry.rbx.comdev, tools | In scope | 2026-11-14 |
| dev-docker-registry-stage.rbx.comdev, staging, tools | In scope | 2026-11-14 |
| dev-stage.rbx.comdev, staging | In scope | 2026-11-14 |
| dev-test.rbx.comdev, test | In scope | 2026-11-14 |
| bloxid.dev.rbx.comdev | In scope | 2026-11-14 |
| cbar.bloxid.dev.rbx.comdev | In scope | 2026-11-14 |
| fang.bloxid.dev.rbx.comdev | In scope | 2026-11-14 |
| fram.bloxid.dev.rbx.comdev | In scope | 2026-11-14 |
| nested.bloxid.dev.rbx.comdev | In scope | 2026-11-14 |
| vpha.bloxid.dev.rbx.comdev | In scope | 2026-11-14 |
| rozilla.dev.rbx.comdev | In scope | 2026-11-14 |
| sentry.dev.rbx.comdev, monitoring | In scope | 2026-11-14 |
| amundsen-dev.di.rbx.comdev | In scope | 2026-11-14 |
| amundsen-es-dev.di.rbx.comdev | In scope | 2026-11-14 |
| amundsen-neo4j-dev.di.rbx.comdev | In scope | 2026-11-14 |
| astro-dev.di.rbx.comdev | In scope | 2026-11-14 |
| alertmanager.astro-dev.di.rbx.comdev, monitoring | In scope | 2026-11-14 |
| app.astro-dev.di.rbx.comdev | In scope | 2026-11-14 |
| deployments.astro-dev.di.rbx.comdev | In scope | 2026-11-14 |
| grafana.astro-dev.di.rbx.comdev, monitoring | In scope | 2026-11-14 |
| houston.astro-dev.di.rbx.comdev | In scope | 2026-11-14 |
| install.astro-dev.di.rbx.comdev | In scope | 2026-11-14 |
| kibana.astro-dev.di.rbx.comdev, monitoring | In scope | 2026-11-14 |
| prometheus.astro-dev.di.rbx.comdev, monitoring | In scope | 2026-11-14 |
| registry.astro-dev.di.rbx.comdev, tools | In scope | 2026-11-14 |
| dev-druid-ash1-monitor.di.rbx.comdev, monitoring | In scope | 2026-11-14 |
| dev-druid-ash1-pivot.di.rbx.comdev | In scope | 2026-11-14 |
| dev-druid-ash1-router.di.rbx.comdev | In scope | 2026-11-14 |
| dev-druid-dc-1.di.rbx.comdev | In scope | 2026-11-14 |
| dev-growth-dc-1.di.rbx.comdev | In scope | 2026-11-14 |
| dev-kubeflow-dc-1.di.rbx.comdev | In scope | 2026-11-14 |
| dev-trinodb-dc-1.di.rbx.comdev | In scope | 2026-11-14 |
| kon-airflow-dev.di.rbx.comdev, tools | In scope | 2026-11-14 |
| superset-dev.di.rbx.comdev, tools | In scope | 2026-11-14 |
| trinodb-dc-airflow-dev.di.rbx.comdev, tools | In scope | 2026-11-14 |
| trinodb-dc-airflow-dev-ash1.di.rbx.comdev, tools | In scope | 2026-11-14 |
| airflow2.dev-core.dic.rbx.comdev, tools | In scope | 2026-11-14 |
| astro.dev-core.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-core.dic.rbx.comdev | In scope | 2026-11-14 |
| spark.dev-core.dic.rbx.comdev | In scope | 2026-11-14 |
| airflow2.dev-creator.dic.rbx.comdev, tools | In scope | 2026-11-14 |
| wildcard.astro.dev-creator.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-data.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-economy.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-engine.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-growth.dic.rbx.comdev | In scope | 2026-11-14 |
| spark.dev-growth.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-infra.dic.rbx.comdev | In scope | 2026-11-14 |
| astro.dev-psc.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-psc.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-safety.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-saki.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-schaffer.dic.rbx.comdev | In scope | 2026-11-14 |
| spark.dev-schaffer.dic.rbx.comdev | In scope | 2026-11-14 |
| wildcard.astro.dev-user.dic.rbx.comdev | In scope | 2026-11-14 |
| superset.dev.dic.rbx.comdev, tools | In scope | 2026-11-14 |
| drone-dev.rbx.comci, dev | In scope | 2026-11-14 |
| drone-dev2.rbx.comci, dev | In scope | 2026-11-14 |
| dev.ee-temporal.rbx.comdev | In scope | 2026-11-14 |
| wildcard.dev.ee-temporal.rbx.comdev | In scope | 2026-11-14 |
| dev2.ee-temporal.rbx.comdev | In scope | 2026-11-14 |
| frontend.dev2.ee-temporal.rbx.comdev | In scope | 2026-11-14 |
| dev.follower.rbx.comdev | In scope | 2026-11-14 |
| grpc.dev.follower.rbx.comapi, dev | In scope | 2026-11-14 |
| fossa-dev.rbx.comdev | In scope | 2026-11-14 |
| github-dev.rbx.comdev, git | In scope | 2026-11-14 |
| github-dev-dr.rbx.comdev, git | In scope | 2026-11-14 |
| dev.github.rbx.comdev, git | In scope | 2026-11-14 |
| growthbook-api-dev.rbx.comapi, dev | In scope | 2026-11-14 |
| growthbook-dev.rbx.comdev | In scope | 2026-11-14 |
| jira-dev.rbx.comdev, tools | In scope | 2026-11-14 |
| knomad-development-production-us-central-1.rbx.comdev | In scope | 2026-11-14 |
| knomad-development-production-us-east-1.rbx.comdev | In scope | 2026-11-14 |
| knomad-development-sitetest1-us-west-1.rbx.comdev | In scope | 2026-11-14 |
| knomad-development-sitetest1-us-west-1b.rbx.comdev | In scope | 2026-11-14 |
| knomad-development-sitetest2-us-west-1.rbx.comdev | In scope | 2026-11-14 |
| knomad-development-sitetest2-us-west-1a.rbx.comdev | In scope | 2026-11-14 |
| knomad-development-sitetest2a-us-west-1.rbx.comdev | In scope | 2026-11-14 |
| knomad-development-sitetest3-us-west-1.rbx.comdev | In scope | 2026-11-14 |
| jwks-dev.lca.rbx.comdev | In scope | 2026-11-14 |
2,245 names are covered by the program's own scope; 2 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.