Skip to content

Bug bounty program

Platform
Bugcrowd
Bounties
Pays
Assets in scope
14
Disclosed reports
0
Subdomains
1,081

Most upvoted reports0

No report of this program is publicly disclosed

Subdomains1,081

Subdomains of LastPass
NameScopeFirst seen
api.lastpass.comapiNot in the scope2026-11-14
cdq-api.lastpass.comapiNot in the scope2026-11-14
cim-api.lastpass.comapiNot in the scope2026-11-14
api.store.lastpass.comapiNot in the scope2026-11-14
vendor-api.lastpass.comapiNot in the scope2026-11-14
cim-api-uat.lastpass.comapi, testNot in the scope2026-11-14
ks-order-api.lastpass.comapiNot in the scope2026-11-14
cds-api.cloud.lastpass.comapiNot in the scope2026-11-14
ks-limits-api.lastpass.comapiNot in the scope2026-11-14
api-keys.cloud.lastpass.comapiNot in the scope2026-11-14
ks-invoice-api.lastpass.comapiNot in the scope2026-11-14
ks-program-api.lastpass.comapiNot in the scope2026-11-14
gws-api-sandbox.lastpass.comapi, testNot in the scope2026-11-14
api-avs.commerce.lastpass.comapiNot in the scope2026-11-14
api-dataplatform.lastpass.comapiNot in the scope2026-11-14
ks-inventory-api.lastpass.comapiNot in the scope2026-11-14
api-boss.commerce.lastpass.comapiNot in the scope2026-11-14
api-keys-dr.cloud.lastpass.comapiNot in the scope2026-11-14
api-avs.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-ips.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-avs.commerce-prod.lastpass.comapiNot in the scope2026-11-14
api-boss.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-ips.commerce-prod.lastpass.comapiNot in the scope2026-11-14
api-boss.commerce-prod.lastpass.comapiNot in the scope2026-11-14
api-copas.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-store.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-avs-rc.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-copas.commerce-prod.lastpass.comapiNot in the scope2026-11-14
api-ips-rc.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-boss-rc.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-copas-rc.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-store-rc.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-boss-test.commerce-dev.lastpass.comapi, dev, testNot in the scope2026-11-14
api-avs-public.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-boss-test.commerce-prod.lastpass.comapi, testNot in the scope2026-11-14
api-avs-public.commerce-prod.lastpass.comapiNot in the scope2026-11-14
api-boss-test-rc.commerce-dev.lastpass.comapi, dev, testNot in the scope2026-11-14
api-eventhandler.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-avs-rc-public.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-boss-internal.commerce-dev.lastpass.comapi, dev, internalNot in the scope2026-11-14
api-eventhandler.commerce-prod.lastpass.comapiNot in the scope2026-11-14
api-boss-internal.commerce-prod.lastpass.comapi, internalNot in the scope2026-11-14
api-copas.commerce-dev-internal.lastpass.comapi, dev, internalNot in the scope2026-11-14
api-copas.commerce-prod-internal.lastpass.comapi, internalNot in the scope2026-11-14
api-eventhandler-rc.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-boss-rc-internal.commerce-dev.lastpass.comapi, dev, internalNot in the scope2026-11-14
api-copas-pmgenerator.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14
api-copas-rc.commerce-dev-internal.lastpass.comapi, dev, internalNot in the scope2026-11-14
api-copas-pmgenerator.commerce-prod.lastpass.comapiNot in the scope2026-11-14
api-copas-pmgenerator-rc.commerce-dev.lastpass.comapi, devNot in the scope2026-11-14

6 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.