Bug bounty program
GY
Gymshark
Most upvoted reports1
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Subdomain takeover on 'de-headless.staging.gymshark.com'#1711890 | Misconfiguration and Insecure Design | 2022-10-27 | – | 31 |
Subdomains571
| Name | Scope | First seen |
|---|---|---|
| dev.gymshark.comdev | In scope | 2026-11-14 |
| develop.gymshark.comdev | In scope | 2026-11-14 |
| develop2.gymshark.comdev | In scope | 2026-11-14 |
| api.develop.gymshark.comapi, dev | In scope | 2026-11-14 |
| fis.develop.gymshark.comdev | In scope | 2026-11-14 |
| k8s.develop.gymshark.comdev, tools | In scope | 2026-11-14 |
| 2048.develop.gymshark.comdev | In scope | 2026-11-14 |
| api.develop2.gymshark.comapi, dev | In scope | 2026-11-14 |
| auth.develop.gymshark.comauth, dev | In scope | 2026-11-14 |
| ftps.develop.gymshark.comdev | In scope | 2026-11-14 |
| gdpr.develop.gymshark.comdev | In scope | 2026-11-14 |
| mike.develop.gymshark.comdev | In scope | 2026-11-14 |
| s3fs.develop.gymshark.comdev | In scope | 2026-11-14 |
| sftp.develop.gymshark.comdata, dev | In scope | 2026-11-14 |
| nginx.develop.gymshark.comdev | In scope | 2026-11-14 |
| athens.develop.gymshark.comdev | In scope | 2026-11-14 |
| events.develop.gymshark.comdev | In scope | 2026-11-14 |
| lambda.develop.gymshark.comdev | In scope | 2026-11-14 |
| whoami.develop.gymshark.comdev | In scope | 2026-11-14 |
| apps.ou.develop.gymshark.comdev | In scope | 2026-11-14 |
| central.develop.gymshark.comdev | In scope | 2026-11-14 |
| lambdas.develop.gymshark.comdev | In scope | 2026-11-14 |
| preview.develop.gymshark.comdev, staging | In scope | 2026-11-14 |
| unleash.develop.gymshark.comdev | In scope | 2026-11-14 |
| whoami2.develop.gymshark.comdev | In scope | 2026-11-14 |
| features.develop.gymshark.comdev | In scope | 2026-11-14 |
| headless.develop.gymshark.comdev | In scope | 2026-11-14 |
| whoami-3.develop.gymshark.comdev | In scope | 2026-11-14 |
| 2048-game.develop.gymshark.comdev | In scope | 2026-11-14 |
| auth.gshq.develop.gymshark.comauth, dev | In scope | 2026-11-14 |
| storybook.develop.gymshark.comdev | In scope | 2026-11-14 |
| uk.lambda.develop.gymshark.comdev | In scope | 2026-11-14 |
| us.lambda.develop.gymshark.comdev | In scope | 2026-11-14 |
| contentful.develop.gymshark.comdev | In scope | 2026-11-14 |
| backinstock.develop.gymshark.comdev | In scope | 2026-11-14 |
| grafana.k8s.develop.gymshark.comdev, monitoring, tools | In scope | 2026-11-14 |
| reviews.api.develop.gymshark.comapi, dev | In scope | 2026-11-14 |
| traefik.k8s.develop.gymshark.comdev, tools | In scope | 2026-11-14 |
| whoami-shop.develop.gymshark.comdev | In scope | 2026-11-14 |
| cdn.training.develop.gymshark.comdev | In scope | 2026-11-14 |
| order.events.develop.gymshark.comdev | In scope | 2026-11-14 |
| consent.proxy.develop.gymshark.comdev | In scope | 2026-11-14 |
| leigh-sandbox.develop.gymshark.comdev, test | In scope | 2026-11-14 |
| prometheus.k8s.develop.gymshark.comdev, monitoring, tools | In scope | 2026-11-14 |
| product.service.develop.gymshark.comdev | In scope | 2026-11-14 |
| qa-test-reports.develop.gymshark.comdev, test | In scope | 2026-11-14 |
| saved-items.api.develop.gymshark.comapi, dev | In scope | 2026-11-14 |
| wildcard.preview.develop.gymshark.comdev, staging | In scope | 2026-11-14 |
| frontend-training.develop.gymshark.comdev | In scope | 2026-11-14 |
| sophie-onboarding.develop.gymshark.comdev | In scope | 2026-11-14 |
| nich-headless-test.develop.gymshark.comdev, test | In scope | 2026-11-14 |
| backinstock.service.develop.gymshark.comdev | In scope | 2026-11-14 |
| lead-generation.api.develop.gymshark.comapi, dev | In scope | 2026-11-14 |
| customer-context.api.develop.gymshark.comapi, dev | In scope | 2026-11-14 |
| identity-service.api.develop.gymshark.comapi, auth, dev | In scope | 2026-11-14 |
| nich-headless-test-us.develop.gymshark.comdev, test | In scope | 2026-11-14 |
| productentity.service.develop.gymshark.comdev | In scope | 2026-11-14 |
| product-entity.service.develop.gymshark.comdev | In scope | 2026-11-14 |
| frontend-onboarding-jan.develop.gymshark.comdev | In scope | 2026-11-14 |
| saved-items-service.api.develop.gymshark.comapi, dev | In scope | 2026-11-14 |
| wildcard.iltija.preview.develop.gymshark.comdev, staging | In scope | 2026-11-14 |
| frontend-training-sumaya.develop.gymshark.comdev | In scope | 2026-11-14 |
| netsuite-events.platform.develop.gymshark.comdev | In scope | 2026-11-14 |
| onboarding-connor.preview.develop.gymshark.comdev, staging | In scope | 2026-11-14 |
| frontend-training-priscilla.develop.gymshark.comdev | In scope | 2026-11-14 |
| wildcard.onboarding-dom.preview.develop.gymshark.comdev, staging | In scope | 2026-11-14 |
| wildcard.onboarding-connor.preview.develop.gymshark.comdev, staging | In scope | 2026-11-14 |
| develop.gymshark.iodev | In scope | 2026-11-14 |
| develop2.gymshark.iodev | In scope | 2026-11-14 |
| fc.develop.gymshark.iodev | In scope | 2026-11-14 |
| api.develop.gymshark.ioapi, dev | In scope | 2026-11-14 |
| develop.api.gymshark.ioapi, dev | In scope | 2026-11-14 |
| fis.develop.gymshark.iodev | In scope | 2026-11-14 |
| api.develop2.gymshark.ioapi, dev | In scope | 2026-11-14 |
| auth.develop.gymshark.ioauth, dev | In scope | 2026-11-14 |
| trap.develop.gymshark.iodev | In scope | 2026-11-14 |
| nginx.develop.gymshark.iodev | In scope | 2026-11-14 |
| api-fc.develop.gymshark.ioapi, dev | In scope | 2026-11-14 |
| assets.develop.gymshark.iodev | In scope | 2026-11-14 |
| config.develop.gymshark.iodev | In scope | 2026-11-14 |
| lambda.develop.gymshark.iodev | In scope | 2026-11-14 |
| rapid7.develop.gymshark.iodev | In scope | 2026-11-14 |
| whoami.develop.gymshark.iodev | In scope | 2026-11-14 |
| product.develop.gymshark.iodev | In scope | 2026-11-14 |
| returns.develop.gymshark.iodev | In scope | 2026-11-14 |
| tableau.develop.gymshark.iodev | In scope | 2026-11-14 |
| kubecost.develop.gymshark.iodev | In scope | 2026-11-14 |
| webhooks.develop.gymshark.iodev | In scope | 2026-11-14 |
| auth.gshq.develop.gymshark.ioauth, dev | In scope | 2026-11-14 |
| backstage.develop.gymshark.iodev | In scope | 2026-11-14 |
| admin.trap.develop.gymshark.ioadmin, dev | In scope | 2026-11-14 |
| redirector.develop.gymshark.iodev | In scope | 2026-11-14 |
| dev-platform.develop.gymshark.iodev | In scope | 2026-11-14 |
| webhooks.api.develop.gymshark.ioapi, dev | In scope | 2026-11-14 |
| admin.tableau.develop.gymshark.ioadmin, dev | In scope | 2026-11-14 |
| consent.proxy.develop.gymshark.iodev | In scope | 2026-11-14 |
| idservice.api.develop.gymshark.ioapi, dev | In scope | 2026-11-14 |
| price.service.develop.gymshark.iodev | In scope | 2026-11-14 |
| rabbitmq-test.develop.gymshark.iodata, dev, test | In scope | 2026-11-14 |
| 1password.scim.develop.gymshark.iodev | In scope | 2026-11-14 |
569 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.