Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.comAnalysed#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.ukAnalysed#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.comAnalysed#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Subdomains of Lyst
NameScopeFirst seen
shopping-cart-pr-885-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-885-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-886-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-886-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-887-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-889-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-889-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-890-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-890-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-890-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-892-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-893-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-895-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-896-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-897-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-897-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-898-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-899-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-899-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-900-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-902-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-903-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-903-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-903-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-904-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-904-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-905-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-905-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-906-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-906-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-906-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-907-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-908-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-908-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-909-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-909-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-909-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-910-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-910-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-911-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-912-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-912-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-912-staging-external-api-cloudflare-alb-d93f77.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-912-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-912-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-913-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-913-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-913-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-914-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-914-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-915-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-915-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-918-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-918-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-919-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-919-staging-external-api-cloudflare-alb-87e6bc.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-919-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-920-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-920-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-921-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-921-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-922-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-922-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-923-staging-external-api-cloudflare-alb-b87de9.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-924-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-925-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-926-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-926-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-927-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-928-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-928-staging-external-api-cloudflare-alb-0a5ae2.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-928-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-929-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-929-staging-external-api-cloudflare-alb-565f4e.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-929-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-929-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-930-staging-external-api-cloudflare-alb-ba8a51.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-930-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-930-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-931-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-931-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-932-staging-external-api-cloudflare-alb-cfa254.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-932-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-932-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-934-staging-external-api-cloudflare-alb-bacd28.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-935-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-935-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-936-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-936-staging-external-api-cloudflare-alb-26cf7d.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-937-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-937-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-937-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-938-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-938-staging-external-api-cloudflare-alb-48bee0.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-938-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-938-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-939-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-940-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-941-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-941-staging-external-api-cloudflare-alb-4106fc.lystit.comapi, stagingIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.