Skip to content
Connect AISign inSign up free

Bug bounty program

LT

Lark Technologies

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
17
Disclosed reports
38
Subdomains
1,634

Most upvoted reports38

All reports
Most upvoted reports of Lark Technologies
ReportWeaknessDisclosedBountyVotes
Stored XSS & SSRF in Lark DocsAnalysed#892049Server-Side Request Forgery2021-02-05$3,000178
Server Side Request ForgeryAnalysed#644238Server-Side Request Forgery2021-03-29–164
Full read SSRF via Lark Docs `import as docs` featureAnalysed#1409727Server-Side Request Forgery2022-01-28$5,000124
Attacker is able to join any tenant on larksuite and view personal files/chats.Analysed#1363185Access Control2021-11-03–84
SSRF with information disclosureAnalysed#810401Server-Side Request Forgery2021-04-27–64
[Lark Android] Vulnerability in exported activity WebViewAnalysed#694053Cross-site Scripting2021-07-22$1,00063
Able to steal private files by manipulating response using Compose Email function of LarkAnalysed#1373784Insecure Direct Object Reference2022-01-25–50
Reflected xss and open redirect on larksuite.com using /?back_uri= parameter.Analysed#955606Cross-site Scripting2022-01-13–49
Sensitive information of helpdesk is being leaked.Analysed#805023Access Control2021-03-06–45
Non privileged user is able to approve his own app himself leading to mass privilege escalations.Analysed#1168475Access Control2021-11-20–45

Subdomains1,634

Root:larksuite.com
Scope
Name suggests
First seen
Text fileClear filters1,532 names
Subdomains of Lark Technologies
NameScopeFirst seen
168money.larksuite.comNot in the scope2026-11-14
1mx1.larksuite.comNot in the scope2026-11-14
5mx2.larksuite.comNot in the scope2026-11-14
917incvn.larksuite.comNot in the scope2026-11-14
a1x66mn0av.larksuite.comNot in the scope2026-11-14
a2yn3bi3vix.larksuite.comNot in the scope2026-11-14
a6kt3eexua.larksuite.comNot in the scope2026-11-14
ac1423f35s.larksuite.comNot in the scope2026-11-14
accounts.larksuite.comNot in the scope2026-11-14
accounts-jp.larksuite.comNot in the scope2026-11-14
accounts-sg.larksuite.comNot in the scope2026-11-14
accounts-us.larksuite.comNot in the scope2026-11-14
acton.larksuite.comNot in the scope2026-11-14
admin.larksuite.comadminNot in the scope2026-11-14
advancegroup.larksuite.comNot in the scope2026-11-14
aedev.larksuite.comNot in the scope2026-11-14
aeoo5ggeawk.larksuite.comNot in the scope2026-11-14
ahadi.larksuite.comNot in the scope2026-11-14
akabizgroup.larksuite.comNot in the scope2026-11-14
alorica.larksuite.comNot in the scope2026-11-14
amir-antivirus.larksuite.comNot in the scope2026-11-14
antivirus.larksuite.comNot in the scope2026-11-14
antivirus-2018.larksuite.comNot in the scope2026-11-14
antivirus-38b65.larksuite.comNot in the scope2026-11-14
antivirus-free.larksuite.comNot in the scope2026-11-14
antivirus-security-free.larksuite.comNot in the scope2026-11-14
antivirus-uk.larksuite.comNot in the scope2026-11-14
painel.antivirus.larksuite.comNot in the scope2026-11-14
anycross.larksuite.comNot in the scope2026-11-14
anycross-sg.larksuite.comNot in the scope2026-11-14
api.larksuite.comapiIn scope2026-11-14
api16-eeftva-gateway.larksuite.comapiNot in the scope2026-11-14
api16-eeftva-imfile.larksuite.comapiNot in the scope2026-11-14
api22-eeftva-docs-quic.larksuite.comapiNot in the scope2026-11-14
api22-eeftva-drive.larksuite.comapiNot in the scope2026-11-14
api22-eeftva-drive-quic.larksuite.comapiNot in the scope2026-11-14
app.larksuite.comIn scope2026-11-14
applink.larksuite.comNot in the scope2026-11-14
aspmx2.larksuite.comNot in the scope2026-11-14
atc-ecom.larksuite.comNot in the scope2026-11-14
attribuly.larksuite.comNot in the scope2026-11-14
avg-antivirus-free.larksuite.comNot in the scope2026-11-14
az16mm75w2.larksuite.comNot in the scope2026-11-14
b5twx5pbxw.larksuite.comNot in the scope2026-11-14
bbe19kju0x.larksuite.comNot in the scope2026-11-14
bc.larksuite.comNot in the scope2026-11-14
130.bc.larksuite.comNot in the scope2026-11-14
33.212.44.130.bc.larksuite.comNot in the scope2026-11-14
34.212.44.130.bc.larksuite.comNot in the scope2026-11-14
35.212.44.130.bc.larksuite.comNot in the scope2026-11-14
36.212.44.130.bc.larksuite.comNot in the scope2026-11-14
37.212.44.130.bc.larksuite.comNot in the scope2026-11-14
38.212.44.130.bc.larksuite.comNot in the scope2026-11-14
39.212.44.130.bc.larksuite.comNot in the scope2026-11-14
40.212.44.130.bc.larksuite.comNot in the scope2026-11-14
41.212.44.130.bc.larksuite.comNot in the scope2026-11-14
42.212.44.130.bc.larksuite.comNot in the scope2026-11-14
43.212.44.130.bc.larksuite.comNot in the scope2026-11-14
44.212.44.130.bc.larksuite.comNot in the scope2026-11-14
45.212.44.130.bc.larksuite.comNot in the scope2026-11-14
46.212.44.130.bc.larksuite.comNot in the scope2026-11-14
47.212.44.130.bc.larksuite.comNot in the scope2026-11-14
48.212.44.130.bc.larksuite.comNot in the scope2026-11-14
49.212.44.130.bc.larksuite.comNot in the scope2026-11-14
50.212.44.130.bc.larksuite.comNot in the scope2026-11-14
51.212.44.130.bc.larksuite.comNot in the scope2026-11-14
52.212.44.130.bc.larksuite.comNot in the scope2026-11-14
53.212.44.130.bc.larksuite.comNot in the scope2026-11-14
54.212.44.130.bc.larksuite.comNot in the scope2026-11-14
55.212.44.130.bc.larksuite.comNot in the scope2026-11-14
56.212.44.130.bc.larksuite.comNot in the scope2026-11-14
57.212.44.130.bc.larksuite.comNot in the scope2026-11-14
58.212.44.130.bc.larksuite.comNot in the scope2026-11-14
59.212.44.130.bc.larksuite.comNot in the scope2026-11-14
60.212.44.130.bc.larksuite.comNot in the scope2026-11-14
61.212.44.130.bc.larksuite.comNot in the scope2026-11-14
62.212.44.130.bc.larksuite.comNot in the scope2026-11-14
63.212.44.130.bc.larksuite.comNot in the scope2026-11-14
209.bc.larksuite.comNot in the scope2026-11-14
127.209.bc.larksuite.comNot in the scope2026-11-14
1.230.127.209.bc.larksuite.comNot in the scope2026-11-14
10.230.127.209.bc.larksuite.comNot in the scope2026-11-14
100.230.127.209.bc.larksuite.comNot in the scope2026-11-14
101.230.127.209.bc.larksuite.comNot in the scope2026-11-14
102.230.127.209.bc.larksuite.comNot in the scope2026-11-14
103.230.127.209.bc.larksuite.comNot in the scope2026-11-14
104.230.127.209.bc.larksuite.comNot in the scope2026-11-14
105.230.127.209.bc.larksuite.comNot in the scope2026-11-14
106.230.127.209.bc.larksuite.comNot in the scope2026-11-14
107.230.127.209.bc.larksuite.comNot in the scope2026-11-14
108.230.127.209.bc.larksuite.comNot in the scope2026-11-14
109.230.127.209.bc.larksuite.comNot in the scope2026-11-14
11.230.127.209.bc.larksuite.comNot in the scope2026-11-14
110.230.127.209.bc.larksuite.comNot in the scope2026-11-14
111.230.127.209.bc.larksuite.comNot in the scope2026-11-14
112.230.127.209.bc.larksuite.comNot in the scope2026-11-14
113.230.127.209.bc.larksuite.comNot in the scope2026-11-14
114.230.127.209.bc.larksuite.comNot in the scope2026-11-14
115.230.127.209.bc.larksuite.comNot in the scope2026-11-14
116.230.127.209.bc.larksuite.comNot in the scope2026-11-14

10 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated