Halloween SaleLowCVSS 0.1 to 3.9
Rewards are pausedPaused- Open redirect or reflected XSS with little impact
- Leak of information that is not sensitive
- Missing limit that lets someone spam staff or members
Roblox Assets Bug Bounty ProgramBreak it.Report it.Get paid.
Find a security hole in Roblox Assets, tell us privately and we pay you. Good-faith research is welcome here.
Rewards
The reward depends on the impact and how easy the bug is to use. We set the final severity with CVSS as a guide and the impact on members and the shop in mind.
The payout
- LowPaused
- MediumPaused
- HighPaused
- CriticalPaused
Paid by PayPal in USD, or as store credit with 25% extra. A bug that chains into something bigger is paid at the higher level.
What a winning report looks like
Exact steps, what an attacker could do with it, and screenshots or a short video. The clearer the proof, the faster you get paid.
- Where it happens: the page, button or command
- Steps we can follow to see it ourselves
- What someone could do with it
$ report --new
idRA-SEC-0001
targetcheckout / payment link
findingOrder paid for $0 by changing the amount
severityCRITICAL 9.4
rewardpaused
statusfixed · paid
Scope
Test what we run ourselves. Services we only use, like the payment provider, are theirs to fix: report those to them.
- webrobloxassets.netEvery page: shop, cart, checkout and payment links
- authAccountsDiscord login, profiles, store credit, gift cards, discount codes
- filesLibraryDownload links and the delivery of paid asset files
- staffTickets and panelsSupport tickets, staff panel, partner dashboard, payouts
- botDiscord botSlash commands, buttons and DMs in our Discord server
Out of scope
- Stripe, Discord, Vercel and Roblox themselves
- Denial of service, load tests, spam, brute forcing
- Phishing or social engineering of members or staff
- Automated scanner output without a working proof
- Missing headers, SPF or DMARC, clickjacking on pages without actions
- Self-XSS, logout CSRF, limits on forms that do nothing sensitive
- Bugs inside the Roblox assets themselves (open a normal ticket)
Rules of engagement
Follow these and you are covered by our safe harbor.
- Your own accounts onlyMake extra test accounts when you need them.
- Hands off other people's dataIf you reach it, stop and report what you found.
- Prove it, do not use itPaid items you got through a bug are removed.
- Stay quiet until it is fixedKeep the bug private until we tell you it is fixed.
- One bug, one reportSame bug twice: the first complete report gets the reward.
- No threats or demandsReports that ask for money before telling the bug get nothing.
Safe harbor
Research that follows these rules and is done in good faith counts as allowed. We will not take legal action against you, ban your account or report you for it, and if anyone else does, we will make clear you had our permission. Not sure if something is allowed? Ask in your report first.
Staff members and partners can report too, but cannot get a cash reward.
How it goes
From your report to your reward.
- Day 0You reportOpen a Security report ticket. Only our management team sees it.
- Within 48hWe answerWe confirm we got it and start reproducing your steps.
- Within 5 daysSeverity setYou hear the level and the reward it pays.
- Fix + 14 daysYou get paidThe fix goes live, we tell you, and the reward follows.
Found something?
Report it privately. Never post a security bug in public channels or normal tickets.
Report a vulnerability