Bug bounty program · HackerOne
Lark Technologies
Most upvoted reports38
- #892049ValidStored XSS & SSRF in Lark DocsLark Technologies · Server-Side Request Forgery · 2021$3,000178votes
- #644238ValidServer Side Request ForgeryLark Technologies · Server-Side Request Forgery · 2021–164votes
- #1409727ValidFull read SSRF via Lark Docs `import as docs` featureLark Technologies · Server-Side Request Forgery · 2022$5,000124votes
- #1363185ValidAttacker is able to join any tenant on larksuite and view personal files/chats.Lark Technologies · Access Control · 2021–84votes
- #810401ValidSSRF with information disclosureLark Technologies · Server-Side Request Forgery · 2021–64votes
- #694053Valid[Lark Android] Vulnerability in exported activity WebViewLark Technologies · Cross-site Scripting · 2021$1,00063votes
- #1373784ValidAble to steal private files by manipulating response using Compose Email function of LarkLark Technologies · Insecure Direct Object Reference · 2022–50votes
- #955606ValidReflected xss and open redirect on larksuite.com using /?back_uri= parameter.Lark Technologies · Cross-site Scripting · 2022–49votes
- #805023ValidSensitive information of helpdesk is being leaked.Lark Technologies · Access Control · 2021–45votes
- #1168475ValidNon privileged user is able to approve his own app himself leading to mass privilege escalations.Lark Technologies · Access Control · 2021 · a user account (title)–45votes
Subdomains1,634
10 covered by the program's own scope · 0 first seen this week
Name suggestsAnything
1,634 names
| Name | Scope | First seen |
|---|---|---|
| abtest-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| abtest-sg-tiktok.byteoversea.com | Not in the scope | 2026-11-14 |
| abtest-va.byteoversea.com | Not in the scope | 2026-11-14 |
| abtest-va-tiktok.byteoversea.com | Not in the scope | 2026-11-14 |
| bds-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| cognition.byteoversea.com | Not in the scope | 2026-11-14 |
| developer-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| wildcard.developer-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| dm.byteoversea.com | Not in the scope | 2026-11-14 |
| dm-maliva-quic.byteoversea.com | Not in the scope | 2026-11-14 |
| dm-maliva16.byteoversea.com | Not in the scope | 2026-11-14 |
| dm-sg-quic.byteoversea.com | Not in the scope | 2026-11-14 |
| dm16.byteoversea.com | Not in the scope | 2026-11-14 |
| dm16-alisg.byteoversea.com | Not in the scope | 2026-11-14 |
| dm16-useast1a.byteoversea.com | Not in the scope | 2026-11-14 |
| dm16-useast2a.byteoversea.com | Not in the scope | 2026-11-14 |
| fb89a3b6273106930d55e9747de3d9d4.byteoversea.com | Not in the scope | 2026-11-14 |
| feedback-va.byteoversea.com | Not in the scope | 2026-11-14 |
| frontier.byteoversea.com | Not in the scope | 2026-11-14 |
| frontier-va.byteoversea.com | Not in the scope | 2026-11-14 |
| gecko-pangle-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| gecko-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| gecko-va.byteoversea.com | Not in the scope | 2026-11-14 |
| gplog-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| gplog-va.byteoversea.com | Not in the scope | 2026-11-14 |
| gpm-mon-va.byteoversea.com | Not in the scope | 2026-11-14 |
| hkvmwvdi.byteoversea.com | Not in the scope | 2026-11-14 |
| i.byteoversea.com | Not in the scope | 2026-11-14 |
| in1.byteoversea.com | Not in the scope | 2026-11-14 |
| in2.byteoversea.com | Not in the scope | 2026-11-14 |
| jsb-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| jsb-va.byteoversea.com | Not in the scope | 2026-11-14 |
| lark-frontier.byteoversea.com | In scope | 2026-11-14 |
| lf16-tcc-tos-i18n.byteoversea.com | Not in the scope | 2026-11-14 |
| libra.byteoversea.com | Not in the scope | 2026-11-14 |
| wildcard.libra.byteoversea.com | Not in the scope | 2026-11-14 |
| log.byteoversea.com | Not in the scope | 2026-11-14 |
| log15.byteoversea.com | Not in the scope | 2026-11-14 |
| log16.byteoversea.com | Not in the scope | 2026-11-14 |
| maliva-mcs.byteoversea.com | Not in the scope | 2026-11-14 |
| mon.byteoversea.com | Not in the scope | 2026-11-14 |
| mon-va.byteoversea.com | Not in the scope | 2026-11-14 |
| mssdk-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| mssdk-sg-bu.byteoversea.com | Not in the scope | 2026-11-14 |
| mssdk-va.byteoversea.com | Not in the scope | 2026-11-14 |
| ngcc.byteoversea.com | Not in the scope | 2026-11-14 |
| oversea.byteoversea.com | Not in the scope | 2026-11-14 |
| p16-ad.byteoversea.com | Not in the scope | 2026-11-14 |
| p16-tcscdn.byteoversea.com | Not in the scope | 2026-11-14 |
| pc-mon-va.byteoversea.com | Not in the scope | 2026-11-14 |
| rtlog.byteoversea.com | Not in the scope | 2026-11-14 |
| s16.byteoversea.com | Not in the scope | 2026-11-14 |
| sdfp-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| sf16-tcc-tos-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| sf16-tcc-tos-va.byteoversea.com | Not in the scope | 2026-11-14 |
| sg-effect.byteoversea.com | Not in the scope | 2026-11-14 |
| sg-link.byteoversea.com | Not in the scope | 2026-11-14 |
| sgali-dpprofile.byteoversea.com | Not in the scope | 2026-11-14 |
| sgali-mcs.byteoversea.com | Not in the scope | 2026-11-14 |
| smr-aliva.byteoversea.com | Not in the scope | 2026-11-14 |
| smr-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| speech-alisg.byteoversea.com | Not in the scope | 2026-11-14 |
| starling-oversea.byteoversea.com | Not in the scope | 2026-11-14 |
| starling-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| starling-va.byteoversea.com | Not in the scope | 2026-11-14 |
| tcc-tos-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| tnc16-alisg.byteoversea.com | Not in the scope | 2026-11-14 |
| tnc16-useast1a.byteoversea.com | Not in the scope | 2026-11-14 |
| toblog.byteoversea.com | Not in the scope | 2026-11-14 |
| tos-alisg16-up.byteoversea.com | Not in the scope | 2026-11-14 |
| tos-alisg2lf.byteoversea.com | Not in the scope | 2026-11-14 |
| tos-awsin16-up.byteoversea.com | Not in the scope | 2026-11-14 |
| tos-d-alisg16-up.byteoversea.com | Not in the scope | 2026-11-14 |
| tos-my16-up.byteoversea.com | Not in the scope | 2026-11-14 |
| tos16-alisg2lf-up.byteoversea.com | Not in the scope | 2026-11-14 |
| tp-pay-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| ttwid-gcp.byteoversea.com | Not in the scope | 2026-11-14 |
| ttwid-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| ttwid-va.byteoversea.com | Not in the scope | 2026-11-14 |
| u003e.byteoversea.com | Not in the scope | 2026-11-14 |
| ug-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| v16-ad.byteoversea.com | Not in the scope | 2026-11-14 |
| v16-tcscdn.byteoversea.com | Not in the scope | 2026-11-14 |
| va-effect.byteoversea.com | Not in the scope | 2026-11-14 |
| va-link.byteoversea.com | Not in the scope | 2026-11-14 |
| vaali-dpprofile.byteoversea.com | Not in the scope | 2026-11-14 |
| vaali-mcs.byteoversea.com | Not in the scope | 2026-11-14 |
| vas-alisg16.byteoversea.com | Not in the scope | 2026-11-14 |
| vas-alisg19.byteoversea.com | Not in the scope | 2026-11-14 |
| vas-maliva16.byteoversea.com | Not in the scope | 2026-11-14 |
| vas-maliva19.byteoversea.com | Not in the scope | 2026-11-14 |
| vcs-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| vcs-va.byteoversea.com | Not in the scope | 2026-11-14 |
| vcs-va-useast2a.byteoversea.com | Not in the scope | 2026-11-14 |
| verification-va.byteoversea.com | Not in the scope | 2026-11-14 |
| verify-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| vmweb-sg.byteoversea.com | Not in the scope | 2026-11-14 |
| vmweb-va.byteoversea.com | Not in the scope | 2026-11-14 |
| vx-bdp.byteoversea.com | Not in the scope | 2026-11-14 |
| wj.byteoversea.com | Not in the scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.