Bug bounty program
LY
Lyst
Most upvoted reports9
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Subdomain takeover of storybook.lystit.comAnalysed#779442 | Access Control | 2020-01-22 | $1,000 | 163 |
| Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589 | Misconfiguration and Insecure Design | 2022-03-22 | – | 45 |
| SSRF at iris.lystit.comAnalysed#206894 | Server-Side Request Forgery | 2017-10-18 | – | 21 |
| CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953 | Cross-Site Request Forgery | 2017-09-28 | $150 | 19 |
| Site configured improperly at subdomain of lyst.co.ukAnalysed#208480 | Misconfiguration and Insecure Design | 2017-03-29 | $100 | 19 |
| [https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047 | Open Redirect | 2022-03-22 | – | 18 |
| DOM XSS on http://talks.lystit.comAnalysed#1031644 | Cross-site Scripting | 2021-02-09 | $100 | 15 |
| Mixed Active content issue on https://www.lyst.com#207329 | Misconfiguration and Insecure Design | 2017-02-22 | – | 12 |
| Bypassing one-time checkout router page (revealing payment information)#271176 | Information Disclosure | 2018-05-10 | – | 12 |
Subdomains1,624
| Name | Scope | First seen |
|---|---|---|
| shopping-cart-pr-885-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-885-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-886-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-886-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-887-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-889-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-889-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-890-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-890-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-890-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-892-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-893-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-895-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-896-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-897-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-897-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-898-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-899-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-899-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-900-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-902-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-903-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-903-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-903-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-904-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-904-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-905-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-905-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-906-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-906-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-906-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-907-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-908-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-908-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-909-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-909-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-909-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-910-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-910-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-911-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-912-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-912-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-912-staging-external-api-cloudflare-alb-d93f77.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-912-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-912-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-913-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-913-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-913-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-914-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-914-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-915-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-915-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-918-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-918-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-919-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-919-staging-external-api-cloudflare-alb-87e6bc.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-919-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-920-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-920-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-921-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-921-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-922-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-922-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-923-staging-external-api-cloudflare-alb-b87de9.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-924-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-925-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-926-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-926-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-927-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-928-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-928-staging-external-api-cloudflare-alb-0a5ae2.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-928-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-929-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-929-staging-external-api-cloudflare-alb-565f4e.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-929-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-929-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-930-staging-external-api-cloudflare-alb-ba8a51.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-930-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-930-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-931-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-931-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-932-staging-external-api-cloudflare-alb-cfa254.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-932-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-932-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-934-staging-external-api-cloudflare-alb-bacd28.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-935-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-935-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-936-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-936-staging-external-api-cloudflare-alb-26cf7d.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-937-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-937-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-937-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-938-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-938-staging-external-api-cloudflare-alb-48bee0.lystit.comapi, staging | In scope | 2026-11-14 |
| shopping-cart-pr-938-staging-web-cloudflare-alb-eks-1-26.lystit.comstaging | In scope | 2026-11-14 |
| shopping-cart-pr-938-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-939-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-940-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| shopping-cart-pr-941-external-api-cloudflare-alb-eks-1-26.lystit.comapi | In scope | 2026-11-14 |
| shopping-cart-pr-941-staging-external-api-cloudflare-alb-4106fc.lystit.comapi, staging | In scope | 2026-11-14 |
1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.