Roblox bug bounty programs

Roblox programs compared: top reward per severity, safe harbor, identity check, first response and status. Amounts are in the currency each program pays.

Program	Critical	High	Medium	Low	Top reward	Safe harbor	KYC	First response	Status
LU Luau Sorona · Bug bounty	–	$6,000	$1,250	$375	$6,000	Partial	–	3 days promised	Open

• LU

  Luau

  Sorona · Bug bounty

  Open

  Top reward

  $6,000

  Critical

  –

  High

  $6,000

  Medium

  $1,250

  Low

  $375

  Safe harbor

  Partial

  First response

  3 days promised

Amounts are the top reward per severity in the currency each program pays. First response is the platform's measured average when it publishes one, else what the policy promises.

• https://luau.org

  Web

• Roblox's HackerOne program lists Roblox Client, Roblox Studio and Roblox Engine as bounty-eligible downloadable executables at critical maximum severity, and Luau's own SECURITY.md routes vulnerability reports there. The Luau repository is not itself a listed asset, so a finding lands on one of those three rows

  Products and areas

• The builtin library surface a sandboxed script can reach: string, table, math, buffer, bit32, coroutine, vector and the os subset

  Products and areas

• The compiler and the bytecode format, meaning the parser, the compiler's optimisation passes and the bytecode encoder and decoder, all reached by compiling attacker-authored source

  Products and areas

• The native code generator on x86-64 and arm64, including its intermediate representation, the optimisation passes over it and the machine-code emitters

  Products and areas

• The sandbox boundary itself together with the embedding surface the repository ships, covering the C API, lua_State handling and the standalone luau and luau-analyze binaries

  Products and areas

• The standard the project sets for itself, which is what a report has to break: no source code may cause memory-safety errors or crashes during compilation or execution, and that guarantee covers the virtual machine, the builtin libraries and native code generation alike

  Products and areas

• The type checker, the autocomplete and require machinery, and the rest of the analysis tooling, insofar as a crash there implies underlying memory unsafety

  Products and areas

• The VM: the bytecode interpreter, value representation and tagging, the garbage collector, and table, userdata and metatable handling

  Products and areas

No target matches. Try part of a host name, such as the company name.