Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.comAnalysed#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.ukAnalysed#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.comAnalysed#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Subdomains of Lyst
NameScopeFirst seen
pims-pr-884-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-888-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-889-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-894-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-895-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-896-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-897-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-899-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-pr-900-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
pims-violet.lystit.comIn scope2026-11-14
plasma.lystit.comIn scope2026-11-14
plasma-metabase.lystit.comtoolsIn scope2026-11-14
problemsets.lystit.comIn scope2026-11-14
prometheus-eks-1-32.lystit.commonitoringIn scope2026-11-14
prometheus-eks-1-36.lystit.commonitoringIn scope2026-11-14
prometheus-eks-ci-1-32.lystit.comci, monitoringIn scope2026-11-14
prometheus-eks-website-1-32.lystit.commonitoringIn scope2026-11-14
prometheus-eks-website-1-36.lystit.commonitoringIn scope2026-11-14
quarantine.lystit.comIn scope2026-11-14
quarantine-2019.lystit.comIn scope2026-11-14
queen.lystit.comIn scope2026-11-14
rabbitmq.lystit.comdataIn scope2026-11-14
retailer.lystit.comIn scope2026-11-14
saka.lystit.comIn scope2026-11-14
sentry.lystit.commonitoringIn scope2026-11-14
shipper.lystit.comIn scope2026-11-14
shipper-internal.lystit.cominternalIn scope2026-11-14
shipper-preview.lystit.comstagingIn scope2026-11-14
shopping-cart.lystit.comIn scope2026-11-14
shopping-cart-external.lystit.comIn scope2026-11-14
shopping-cart-external-eu.lystit.comIn scope2026-11-14
shopping-cart-external-staging.lystit.comstagingIn scope2026-11-14
shopping-cart-external-uk.lystit.comIn scope2026-11-14
shopping-cart-external-us.lystit.comIn scope2026-11-14
shopping-cart-pr-849-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-849-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-850-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-850-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-852-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-852-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-853-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-853-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-854-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-854-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-855-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-855-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-855-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-856-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-856-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-857-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-857-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-858-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-858-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-859-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-860-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-860-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-861-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-863-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-863-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-863-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-864-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-865-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-865-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-866-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-866-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-867-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-867-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-867-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-868-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-868-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-869-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-869-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-869-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-870-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-872-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-872-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-873-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-873-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-873-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-874-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-874-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-875-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-876-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-876-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-876-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-877-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-878-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-878-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-879-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-880-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-881-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-881-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-881-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-882-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-882-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-883-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-883-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-883-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-884-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-884-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.