Bug bounty program
LY
Lyst
Most upvoted reports9
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Subdomain takeover of storybook.lystit.comAnalysed#779442 | Access Control | 2020-01-22 | $1,000 | 163 |
| Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589 | Misconfiguration and Insecure Design | 2022-03-22 | – | 45 |
| SSRF at iris.lystit.com#206894 | Server-Side Request Forgery | 2017-10-18 | – | 21 |
| CSRF - Adding unlimited number of saved items via GET request#205953 | Cross-Site Request Forgery | 2017-09-28 | $150 | 19 |
| Site configured improperly at subdomain of lyst.co.uk#208480 | Misconfiguration and Insecure Design | 2017-03-29 | $100 | 19 |
| [https://█████████/]&&[https://█████████/] Open Redirection#537047 | Open Redirect | 2022-03-22 | – | 18 |
| DOM XSS on http://talks.lystit.com#1031644 | Cross-site Scripting | 2021-02-09 | $100 | 15 |
| Mixed Active content issue on https://www.lyst.com#207329 | Misconfiguration and Insecure Design | 2017-02-22 | – | 12 |
| Bypassing one-time checkout router page (revealing payment information)#271176 | Information Disclosure | 2018-05-10 | – | 12 |
Subdomains1,624
| Name | Scope | First seen |
|---|---|---|
| braze-api.lystit.comapi | In scope | 2026-11-14 |
| braze-api-pr-634-web-public-cloudflare-alb.eks-1-32.cztio.lystit.comapi | In scope | 2026-11-14 |
| braze-api-pr-635-web-public-cloudflare-alb.eks-1-32.cztio.lystit.comapi | In scope | 2026-11-14 |
| braze-api-pr-636-web-public-cloudflare-alb.eks-1-32.cztio.lystit.comapi | In scope | 2026-11-14 |
| braze-api-pr-637-web-public-cloudflare-alb.eks-1-32.cztio.lystit.comapi | In scope | 2026-11-14 |
| mobile-api-pr-4113-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4178-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4184-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4185-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4186-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4188-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4190-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4191-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4192-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4193-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4194-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4195-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4196-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4198-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4199-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4200-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4201-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4202-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4203-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4204-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4205-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4206-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4207-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4208-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4209-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4210-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4211-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4212-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4213-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4214-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-4217-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comNewapi, internal | In scope | 2026-11-15 |
| mobile-api-pr-3856-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3861-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3867-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3868-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3870-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3872-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3875-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3876-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3877-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3879-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3880-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3881-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3882-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3883-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3888-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3889-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3890-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3893-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3894-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3897-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3898-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobile-api-pr-3900-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internal | In scope | 2026-11-14 |
| mobileapi-swagger.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-849-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-850-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-852-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-853-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-854-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-855-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-856-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-857-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-858-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-860-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-861-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-863-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-864-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-865-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-866-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-867-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-868-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-869-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-870-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-872-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-873-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-874-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-876-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-877-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-878-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-879-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-881-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-882-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-883-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-885-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-886-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-887-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-889-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-890-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-893-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-896-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-899-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-903-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-905-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-906-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-908-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.