Skip to content

Bug bounty program

Platform
Bugcrowd
Bounties
Pays
Assets in scope
13
Disclosed reports
0
Subdomains
1,116

Most upvoted reports0

No report of this program is publicly disclosed

Subdomains1,116

Subdomains of lululemon
NameScopeFirst seen
dev.api.lululemon.comapi, devIn scope2026-11-14
ap.dev.api.lululemon.comapi, devIn scope2026-11-14
eu.dev.api.lululemon.comapi, devIn scope2026-11-14
na.dev.api.lululemon.comapi, devIn scope2026-11-14
platform-dev.api.lululemon.comapi, devIn scope2026-11-14
apim-dev.apigeeaccess.lululemon.comdevIn scope2026-11-14
www.apim-dev.apigeeaccess.lululemon.comdevIn scope2026-11-14
apis-dev-np.lululemon.comapi, devIn scope2026-11-14
apis-sandbox-dev-np.lululemon.comapi, dev, testIn scope2026-11-14
dev.lululemon.comdevIn scope2026-11-14
dev-iexpense.lululemon.comdevIn scope2026-11-14
dev-lookbook.lululemon.comdevIn scope2026-11-14
dev8.lululemon.comdevIn scope2026-11-14
dev9.lululemon.comdevIn scope2026-11-14
developers-dev.lululemon.comdevIn scope2026-11-14
localhost.e.lululemon.comdevIn scope2026-11-14
ehc-dev.lululemon.comdevIn scope2026-11-14
fr-dev9.lululemon.comdevIn scope2026-11-14
fr-preview-dev9.lululemon.comdev, stagingIn scope2026-11-14
localhost.info.lululemon.comdevIn scope2026-11-14
dev.pos-api.lululemon.comapi, devIn scope2026-11-14
dev.posapi.lululemon.comdevIn scope2026-11-14
dev.preprod-apis.lululemon.comapi, dev, stagingIn scope2026-11-14
sandbox-dev.preprod-apis.lululemon.comapi, dev, staging, testIn scope2026-11-14
preview-dev8.lululemon.comdev, stagingIn scope2026-11-14
preview-dev9.lululemon.comdev, stagingIn scope2026-11-14
apim-dev.proxyonboarding.lululemon.comdevIn scope2026-11-14
www.apim-dev.proxyonboarding.lululemon.comdevIn scope2026-11-14
apim-dev.tokenapi.lululemon.comdevIn scope2026-11-14
www.apim-dev.tokenapi.lululemon.comdevIn scope2026-11-14
trade-dev.lululemon.comdevIn scope2026-11-14
www.trade-dev.lululemon.comdevIn scope2026-11-14
dev-npd.wholesale.lululemon.comdevIn scope2026-11-14

1,091 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.