Bug bounty program
LY
Lyst
Most upvoted reports9
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Subdomain takeover of storybook.lystit.comAnalysed#779442 | Access Control | 2020-01-22 | $1,000 | 163 |
| Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589 | Misconfiguration and Insecure Design | 2022-03-22 | – | 45 |
| SSRF at iris.lystit.comAnalysed#206894 | Server-Side Request Forgery | 2017-10-18 | – | 21 |
| CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953 | Cross-Site Request Forgery | 2017-09-28 | $150 | 19 |
| Site configured improperly at subdomain of lyst.co.ukAnalysed#208480 | Misconfiguration and Insecure Design | 2017-03-29 | $100 | 19 |
| [https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047 | Open Redirect | 2022-03-22 | – | 18 |
| DOM XSS on http://talks.lystit.comAnalysed#1031644 | Cross-site Scripting | 2021-02-09 | $100 | 15 |
| Mixed Active content issue on https://www.lyst.com#207329 | Misconfiguration and Insecure Design | 2017-02-22 | – | 12 |
| Bypassing one-time checkout router page (revealing payment information)#271176 | Information Disclosure | 2018-05-10 | – | 12 |
Subdomains1,624
| Name | Scope | First seen |
|---|---|---|
| pims-pr-884-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| pims-pr-888-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| pims-pr-889-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| pims-pr-894-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| pims-pr-895-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| pims-pr-896-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| pims-pr-897-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| pims-pr-899-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| pims-pr-900-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| pims-violet.lystit.com | In scope | 2026-11-14 |
| plasma.lystit.com | In scope | 2026-11-14 |
| plasma-metabase.lystit.comtools | In scope | 2026-11-14 |
| problemsets.lystit.com | In scope | 2026-11-14 |
| prometheus-eks-1-32.lystit.commonitoring | In scope | 2026-11-14 |
| prometheus-eks-1-36.lystit.commonitoring | In scope | 2026-11-14 |
| prometheus-eks-ci-1-32.lystit.comci, monitoring | In scope | 2026-11-14 |
| prometheus-eks-website-1-32.lystit.commonitoring | In scope | 2026-11-14 |
| prometheus-eks-website-1-36.lystit.commonitoring | In scope | 2026-11-14 |
| quarantine.lystit.com | In scope | 2026-11-14 |
| quarantine-2019.lystit.com | In scope | 2026-11-14 |
| queen.lystit.com | In scope | 2026-11-14 |
| rabbitmq.lystit.comdata | In scope | 2026-11-14 |
| retailer.lystit.com | In scope | 2026-11-14 |
| saka.lystit.com | In scope | 2026-11-14 |
| sentry.lystit.commonitoring | In scope | 2026-11-14 |
| shipper.lystit.com | In scope | 2026-11-14 |
| shipper-internal.lystit.cominternal | In scope | 2026-11-14 |
| shipper-preview.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart.lystit.com | In scope | 2026-11-14 |
| shopping-cart-external.lystit.com | In scope | 2026-11-14 |
| shopping-cart-external-eu.lystit.com | In scope | 2026-11-14 |
| shopping-cart-external-staging.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-external-uk.lystit.com | In scope | 2026-11-14 |
| shopping-cart-external-us.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-849-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-849-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-850-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-850-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-852-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-852-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-853-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-853-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-854-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-854-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-855-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-855-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-855-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-856-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-856-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-857-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-857-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-858-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-858-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-859-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-860-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-860-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-861-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-863-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-863-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-863-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-864-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-865-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-865-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-866-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-866-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-867-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-867-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-867-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-868-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-868-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-869-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-869-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-869-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-870-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-872-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-872-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-873-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-873-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-873-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-874-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-874-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-875-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-876-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-876-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-876-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-877-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-878-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-878-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-879-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-880-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-881-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-881-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-881-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-882-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-882-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-883-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-883-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-883-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-884-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-884-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.