Skip to content
Connect AISign inSign up free

Bug bounty program

LE

lemlist

Open on HackerOneAtlas
Platform
HackerOne
Bounties
None
Assets in scope
5
Disclosed reports
14
Subdomains
91

Most upvoted reports14

All reports
Most upvoted reports of lemlist
ReportWeaknessDisclosedBountyVotes
Authentication Bypass in Subscription Management EndpointAnalysed#3417162Insecure Direct Object Reference2025-11-17–68
Unauthorized Password Reset Allows Account Takeover Across Tenant BoundariesAnalysed#3378635No weakness recorded2025-11-07–65
Authentication Token Theft via Open Redirect in Callback URL ParameterAnalysed#3419636Authentication2025-11-14–60
stored xss in app.lemlist.comAnalysed#919859Cross-site Scripting2020-07-21–26
Unrestricted File Upload on https://app.lemlist.comAnalysed#722919File and Path Handling2020-04-01–24
SSRF in img.lemlist.com that leads to Localhost Port ScanningAnalysed#783392Server-Side Request Forgery2020-05-28–23
Stored XSS at [ █████ ] in " LINKEDIN URL" Field.#932557Cross-site Scripting2020-07-24–18
[app.lemlist.com] Improper handling of payment lead to bypass payment#1420697Input Validation and Logic2022-05-17–18
Security misconfiguration#1486327Misconfiguration and Insecure Design2022-05-16–15
Clickjacking at app.lemlist.com#1574017Misconfiguration and Insecure Design2022-05-20–13

Subdomains91

Root
Scope:Not in the scope
Name suggests
First seen
Text fileClear filters88 names
Subdomains of lemlist
NameScopeFirst seen
academy.lemlist.comNot in the scope2026-11-14
admin.lemlist.comadminNot in the scope2026-11-14
api2.lemlist.comapiNot in the scope2026-11-14
www.app.lemlist.comNot in the scope2026-11-14
app0.lemlist.comNot in the scope2026-11-14
app2.lemlist.comNot in the scope2026-11-14
backup.lemlist.comdataNot in the scope2026-11-14
blog.lemlist.comNot in the scope2026-11-14
blog2.lemlist.comNot in the scope2026-11-14
change.lemlist.comNot in the scope2026-11-14
chimera.lemlist.comNot in the scope2026-11-14
coach.lemlist.comNot in the scope2026-11-14
cust1.lemlist.comNot in the scope2026-11-14
cust2.lemlist.comNot in the scope2026-11-14
custom.lemlist.comNot in the scope2026-11-14
custom2.lemlist.comNot in the scope2026-11-14
db.lemlist.comdataNot in the scope2026-11-14
developer.lemlist.comNot in the scope2026-11-14
email.lemlist.comNot in the scope2026-11-14
links.emails.lemlist.comNot in the scope2026-11-14
files.lemlist.comdataNot in the scope2026-11-14
flavourfoundry.lemlist.comNot in the scope2026-11-14
fr.lemlist.comNot in the scope2026-11-14
free-tools.lemlist.comNot in the scope2026-11-14
get.lemlist.comNot in the scope2026-11-14
help.lemlist.comNot in the scope2026-11-14
img.lemlist.comNot in the scope2026-11-14
lab.lemlist.comNot in the scope2026-11-14
leadfinder.lemlist.comNot in the scope2026-11-14
app.leadfinder.lemlist.comNot in the scope2026-11-14
api.app.leadfinder.lemlist.comapiNot in the scope2026-11-14
staging.app.leadfinder.lemlist.comstagingNot in the scope2026-11-14
api.staging.app.leadfinder.lemlist.comapi, stagingNot in the scope2026-11-14
daily.leadfinder.lemlist.comNot in the scope2026-11-14
mcp.leadfinder.lemlist.comNot in the scope2026-11-14
s.leadfinder.lemlist.comNot in the scope2026-11-14
sample.leadfinder.lemlist.comNot in the scope2026-11-14
staging.leadfinder.lemlist.comstagingNot in the scope2026-11-14
wvd.staging.leadfinder.lemlist.comstagingNot in the scope2026-11-14
wvd.leadfinder.lemlist.comNot in the scope2026-11-14
lemhero.lemlist.comNot in the scope2026-11-14
link.lemlist.comNot in the scope2026-11-14
loginless.lemlist.comNot in the scope2026-11-14
lp.lemlist.comNot in the scope2026-11-14
email.m.lemlist.comNot in the scope2026-11-14
mobile.lemlist.comNot in the scope2026-11-14
mobile-signup.lemlist.comNot in the scope2026-11-14
ondemand.lemlist.comNot in the scope2026-11-14
ondemand-ext.lemlist.comNot in the scope2026-11-14
opera.lemlist.comNot in the scope2026-11-14
pages.lemlist.comNot in the scope2026-11-14
parking.lemlist.comNot in the scope2026-11-14
pix.lemlist.comNot in the scope2026-11-14
pop.lemlist.comNot in the scope2026-11-14
proxy.lemlist.comNot in the scope2026-11-14
rp.lemlist.comNot in the scope2026-11-14
sheets.lemlist.comNot in the scope2026-11-14
signup.lemlist.comNot in the scope2026-11-14
smtp.lemlist.commailNot in the scope2026-11-14
spendourmoney.lemlist.comNot in the scope2026-11-14
staging.lemlist.comstagingNot in the scope2026-11-14
staging-sheets.lemlist.comstagingNot in the scope2026-11-14
app.staging.lemlist.comstagingNot in the scope2026-11-14
custom.staging.lemlist.comstagingNot in the scope2026-11-14
enter.staging.lemlist.comstagingNot in the scope2026-11-14
mcp.staging.lemlist.comstagingNot in the scope2026-11-14
parking.staging.lemlist.comstagingNot in the scope2026-11-14
staging0.lemlist.comstagingNot in the scope2026-11-14
staging1.lemlist.comstagingNot in the scope2026-11-14
custom.staging1.lemlist.comstagingNot in the scope2026-11-14
domain.staging1.lemlist.comstagingNot in the scope2026-11-14
files.staging1.lemlist.comdata, stagingNot in the scope2026-11-14
parking.staging1.lemlist.comstagingNot in the scope2026-11-14
staging2.lemlist.comstagingNot in the scope2026-11-14
status.lemlist.commonitoringNot in the scope2026-11-14
temp.lemlist.comNot in the scope2026-11-14
test.lemlist.comtestNot in the scope2026-11-14
theoldblog.lemlist.comNot in the scope2026-11-14
trail.lemlist.comNot in the scope2026-11-14
trust.lemlist.comNot in the scope2026-11-14
university.lemlist.comNot in the scope2026-11-14
update.lemlist.comNot in the scope2026-11-14
upflow-email.lemlist.comNot in the scope2026-11-14
vip.lemlist.comNot in the scope2026-11-14
visitors.lemlist.comNot in the scope2026-11-14
visitors-staging-ext.lemlist.comstagingNot in the scope2026-11-14
visitors-staging1-ext.lemlist.comstagingNot in the scope2026-11-14
web-assets.lemlist.comNot in the scope2026-11-14

1 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated