Browse / Roblox

Roblox

See its reports on the map

Attack surface: 2,241 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Roblox

• Authentication1
• Insecure Direct Object Reference1
• Access Control1
• Cross-site Scripting1
• Denial of Service1

Most upvoted reports

AllValidInformativeN/ADuplicate

1. Subdomain Takeover to Authentication bypass Improper Authentication - Generic · critical
   783 votes
2. Insecure redirect rule results in bypassing ban redirect on certain pagesInsecure Direct Object Reference (IDOR) · medium
   233 votes
3. Subdomain Takeover at creatorforum.roblox.comPrivilege Escalation · high
   90 votes
4. Reflected XSS through multiple inputs in the issue collector on JiraCross-site Scripting (XSS) - Reflected · medium
   56 votes
5. Malformed string sent through FireServer leads to server freezing/hangingUncontrolled Resource Consumption · medium
   44 votes