Luau

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical (table minimum, Roblox awards up from here) │ $20,000 │ $21,000 High │ $5,000 │ $6,000 Medium │ $1,000 │ $1,250 Low │ $300 │ $375 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Memory safety 50 % Code execution 25 % Denial of service 15 % Parsing/validation 5 % Latest advisories Loading the feed Overview Luau is Roblox's Lua-derived language and sandboxed virtual machine, executing on every Roblox client and server for something on the order of 80 to 100 million daily active users, all of whom can supply arbitrary script input by design. That makes it the single largest deployment of an intentionally hostile-input scripting sandbox in consumer software, and it is increasingly embedded outside Roblox as a general-purpose scripting language precisely because of that sandbox. The project's own SECURITY.md is unusually direct about what counts: the VM, the builtin libraries and the native code generation facilities must not produce memory-safety errors or crashes on any source code, and violations of memory safety are considered vulnerabilities. Reports route to Roblox on HackerOne, where the table runs $300 for low, $1,000 for medium, $5,000 for high and $20,000 for critical, and those numbers are minimums the program awards up from. sorona.xyz adds 1.25x on top of whatever Roblox awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times 3 business days First response 2-10 business days Triage 20-40 business days from triage Bounty In scope Roblox's HackerOne program lists Roblox Client, Roblox Studio and Roblox Engine as bounty-eligible downloadable executables at critical maximum severity, and Luau's own SECURITY.md routes vulnerability reports there. The Luau repository is not itself a listed asset, so a finding lands on one of those three rows The standard the project sets for itself, which is what a report has to break: no source code may cause memory-safety errors or crashes during compilation or execution, and that guarantee covers the virtual machine, the builtin libraries and native code generation alike The VM: the bytecode interpreter, value representation and tagging, the garbage collector, and table, userdata and metatable handling The compiler and the bytecode format, meaning the parser, the compiler's optimisation passes and the bytecode encoder and decoder, all reached by compiling attacker-authored source The native code generator on x86-64 and arm64, including its intermediate representation, the optimisation passes over it and the machine-code emitters The builtin library surface a sandboxed script can reach: string , table , math , buffer , bit32 , coroutine , vector and the os subset The sandbox boundary itself together with the embedding surface the repository ships, covering the C API, lua_State handling and the standalone luau and luau-analyze binaries The type checker, the autocomplete and require machinery, and the rest of the analysis tooling, insofar as a crash there implies underlying memory unsafety Out of scope Feeding hand-crafted bytecode straight to the VM, since the runtime expects valid compiler output and offers no security guarantees for anything else Resource exhaustion during compilation or execution, because Luau provides no termination guarantees and says so Vulnerabilities in custom C functions that an embedding host exposes, rather than in Luau itself Findings that cannot be shown through Roblox Client, Roblox Studio or Roblox Engine, none of which the Luau repository substitutes for Defects in Roblox's web and platform assets that do not run through Luau, which the program prices on its own wildcard rows rather than on this entry Testing carried out without the required hackeronetest- user agent, which is how the program attributes the traffic to you Fully weaponized RCE chains against production clients, which Roblox prohibits without written authorization Most-valued findings A sandbox escape from ordinary Luau script into host code execution inside Roblox Client, Studio or Engine, the class the program names outright and the one that reaches the critical band Memory-safety violations in the interpreter, garbage collector or table and userdata handling reached from compiler-produced bytecode Native code generation bugs where the JIT emits a sequence that breaks an invariant the interpreter holds Compiler or bytecode encoder flaws that produce unsafe bytecode from source Luau accepted as valid Data model vulnerabilities used by exploiters to crash game servers, which Roblox states are in scope and encouraged Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The payable assets are Roblox Client, Roblox Studio and Roblox Engine, so a Luau VM bug has to be demonstrated through one of those binaries rather than against the repo in isolation Hand-crafted bytecode fed straight to the VM is out of scope: the runtime only guarantees safety for bytecode the Luau compiler produced Resource exhaustion is out of scope, because Luau does not offer termination guarantees and some code will legitimately exhaust CPU or RAM Your user agent must carry hackeronetest- while testing so the program can attribute the traffic Fully weaponized RCE chains against production clients are prohibited without written authorization from Roblox Do not disclose the vulnerability, or the contents of your submission, to anyone without explicit Roblox authorization Program stats 921 Reports resolved $1.22M Bounties paid 85% Response efficiency Disclosure Coordinated through Roblox on HackerOne, and Roblox treats disclosure to any other person without its explicit authorization as a violation of the program. Because that clause can be read as covering a sorona.xyz-routed report, file with Roblox directly and keep the discussion on HackerOne; sorona.xyz holds anything you share with us until Roblox has authorized publication. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability