Skip to content
Connect AISign inSign up free

Bug bounty program

LY

Lyst

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.comAnalysed#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.ukAnalysed#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.comAnalysed#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Root
Scope
Name suggests
First seen
Text file1,624 names
Subdomains of Lyst
NameScopeFirst seen
lyst-website-pr-21637-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21639-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21641-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21644-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21647-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21648-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21649-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21655-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21657-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21660-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21663-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21667-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21670-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21671-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21672-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21673-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21674-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21675-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21678-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21679-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21681-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
mailchimp-gdpr.lystit.comIn scope2026-11-14
mailchimp-gdpr-pr-12-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
meryl.lystit.comIn scope2026-11-14
meryl-d.lystit.comIn scope2026-11-14
meryl-pr-141-web-dedupe-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
metric-tree-viewer.lystit.comIn scope2026-11-14
microservices-empire.lystit.comIn scope2026-11-14
microservices-empire-internal.lystit.cominternalIn scope2026-11-14
mobile-api-pr-3856-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3861-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3867-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3868-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3870-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3872-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3875-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3876-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3877-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3879-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3880-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3881-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3882-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3883-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3888-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3889-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3890-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3893-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3894-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3897-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3898-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-3900-web-private-cloudflare-alb-eks-1-26.lystit.comapi, internalIn scope2026-11-14
mobileapi.lystit.comIn scope2026-11-14
mobileapi-swagger.lystit.comapiIn scope2026-11-14
moderation.lystit.comIn scope2026-11-14
www.moderation.lystit.comIn scope2026-11-14
npm.lystit.comIn scope2026-11-14
openvas.lystit.comIn scope2026-11-14
openvpn.lystit.comvpnIn scope2026-11-14
openvpn-access.lystit.comvpnIn scope2026-11-14
openvpn-access-07.lystit.comvpnIn scope2026-11-14
os.lystit.comIn scope2026-11-14
packages.lystit.comIn scope2026-11-14
packages-internal.lystit.cominternalIn scope2026-11-14
packages-web.lystit.comIn scope2026-11-14
partner-dash-pr-460-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
partner-dash-pr-461-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
partner-dash-pr-464-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
partner-dash-pr-465-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pes.lystit.comIn scope2026-11-14
pes-test.lystit.comtestIn scope2026-11-14
pims.lystit.comIn scope2026-11-14
pims-pr-799-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-800-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-839-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-841-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-842-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-844-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-848-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-849-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-850-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-851-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-852-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-853-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-855-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-857-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-858-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-859-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-860-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-862-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-863-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-864-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-865-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-867-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-869-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-870-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-871-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-872-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-879-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-880-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-881-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated