Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.comAnalysed#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.ukAnalysed#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.comAnalysed#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Subdomains of Lyst
NameScopeFirst seen
lyst-website-pr-21449-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21451-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21452-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21454-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21458-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21459-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21460-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21465-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21466-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21467-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21468-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21469-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21470-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21471-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21472-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21473-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21474-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21476-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21478-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21479-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21480-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21482-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21483-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21484-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21485-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21486-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21487-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21489-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21490-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21493-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21496-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21498-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21500-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21501-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21502-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21503-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21507-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21512-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21514-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21515-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21518-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21519-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21522-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21526-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21527-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21530-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21531-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21532-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21536-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21539-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21540-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21542-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21543-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21545-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21549-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21553-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21554-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21556-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21562-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21563-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21564-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21566-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21567-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21568-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21569-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21571-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21572-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21574-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21575-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21576-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21578-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21581-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21586-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21587-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21588-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21589-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21590-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21593-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21594-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21596-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21597-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21599-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21600-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21601-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21604-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21606-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21608-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21610-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21611-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21613-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21615-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21617-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21618-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21620-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21623-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21624-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21626-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21627-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21633-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21635-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.