Skip to content
Connect AISign inSign up free

Bug bounty program

LY

Lyst

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.comAnalysed#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.ukAnalysed#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.comAnalysed#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Root
Scope
Name suggests
First seen
Text file1,624 names
Subdomains of Lyst
NameScopeFirst seen
shopping-cart-pr-942-staging-external-api-cloudflare-alb-f10912.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-pr-942-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-942-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-943-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-943-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-943-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-944-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-945-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-946-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-946-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-946-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
shopping-cart-pr-947-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-948-staging-web-cloudflare-alb-eks-1-26.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-949-external-api-cloudflare-alb-eks-1-26.lystit.comapiIn scope2026-11-14
shopping-cart-pr-949-staging-external-api-cloudflare-alb-4b6b41.lystit.comapi, stagingIn scope2026-11-14
shopping-cart-staging.lystit.comstagingIn scope2026-11-14
shopping-cart-staging-external-eu.lystit.comstagingIn scope2026-11-14
shopping-cart-staging-external-uk.lystit.comstagingIn scope2026-11-14
shopping-cart-staging-external-us.lystit.comstagingIn scope2026-11-14
shopping-cart-staging-violet.lystit.comstagingIn scope2026-11-14
shopping-cart-violet.lystit.comIn scope2026-11-14
skc-webhook-receiver.lystit.comIn scope2026-11-14
smart.lystit.comIn scope2026-11-14
user-web.smart.lystit.comIn scope2026-11-14
srv.lystit.comIn scope2026-11-14
bootstraptest-eks.srv.lystit.comIn scope2026-11-14
cron-eks.srv.lystit.comIn scope2026-11-14
echo-aleph.cron-eks.srv.lystit.comIn scope2026-11-14
echo-bet.cron-eks.srv.lystit.comIn scope2026-11-14
dex-test.srv.lystit.comtestIn scope2026-11-14
eks-1-17.srv.lystit.comIn scope2026-11-14
eks-1-17-redux.srv.lystit.comIn scope2026-11-14
eks-1-18.srv.lystit.comIn scope2026-11-14
cloudflare.eks-1-18.srv.lystit.comIn scope2026-11-14
intalb.eks-1-18.srv.lystit.comIn scope2026-11-14
intelb.eks-1-18.srv.lystit.comIn scope2026-11-14
todayisnew.intelb.eks-1-18.srv.lystit.comIn scope2026-11-14
internal.eks-1-18.srv.lystit.cominternalIn scope2026-11-14
intnlb.eks-1-18.srv.lystit.comIn scope2026-11-14
public.eks-1-18.srv.lystit.comIn scope2026-11-14
restricted-public.eks-1-18.srv.lystit.comIn scope2026-11-14
rpubelb.eks-1-18.srv.lystit.comIn scope2026-11-14
eks-1-18b.srv.lystit.comIn scope2026-11-14
eks-1-19.srv.lystit.comIn scope2026-11-14
cloudflare.eks-1-19.srv.lystit.comIn scope2026-11-14
intalb.eks-1-19.srv.lystit.comIn scope2026-11-14
intelb.eks-1-19.srv.lystit.comIn scope2026-11-14
internal.eks-1-19.srv.lystit.cominternalIn scope2026-11-14
intnlb.eks-1-19.srv.lystit.comIn scope2026-11-14
public.eks-1-19.srv.lystit.comIn scope2026-11-14
restricted-public.eks-1-19.srv.lystit.comIn scope2026-11-14
rpubelb.eks-1-19.srv.lystit.comIn scope2026-11-14
eks-1-20.srv.lystit.comIn scope2026-11-14
eks-1-20-b.srv.lystit.comIn scope2026-11-14
cloudflare.eks-1-20-b.srv.lystit.comIn scope2026-11-14
intalb.eks-1-20-b.srv.lystit.comIn scope2026-11-14
intelb.eks-1-20-b.srv.lystit.comIn scope2026-11-14
internal.eks-1-20-b.srv.lystit.cominternalIn scope2026-11-14
intnlb.eks-1-20-b.srv.lystit.comIn scope2026-11-14
public.eks-1-20-b.srv.lystit.comIn scope2026-11-14
restricted-public.eks-1-20-b.srv.lystit.comIn scope2026-11-14
rpubelb.eks-1-20-b.srv.lystit.comIn scope2026-11-14
eks-1-20-nlb.srv.lystit.comIn scope2026-11-14
cloudflare.eks-1-20-nlb.srv.lystit.comIn scope2026-11-14
intalb.eks-1-20-nlb.srv.lystit.comIn scope2026-11-14
intelb.eks-1-20-nlb.srv.lystit.comIn scope2026-11-14
internal.eks-1-20-nlb.srv.lystit.cominternalIn scope2026-11-14
intnlb.eks-1-20-nlb.srv.lystit.comIn scope2026-11-14
public.eks-1-20-nlb.srv.lystit.comIn scope2026-11-14
restricted-public.eks-1-20-nlb.srv.lystit.comIn scope2026-11-14
rpubelb.eks-1-20-nlb.srv.lystit.comIn scope2026-11-14
eks-1-20-nr-prod-trial.srv.lystit.comIn scope2026-11-14
cloudflare.eks-1-20-nr-prod-trial.srv.lystit.comIn scope2026-11-14
intalb.eks-1-20-nr-prod-trial.srv.lystit.comIn scope2026-11-14
intelb.eks-1-20-nr-prod-trial.srv.lystit.comIn scope2026-11-14
internal.eks-1-20-nr-prod-trial.srv.lystit.cominternalIn scope2026-11-14
intnlb.eks-1-20-nr-prod-trial.srv.lystit.comIn scope2026-11-14
public.eks-1-20-nr-prod-trial.srv.lystit.comIn scope2026-11-14
restricted-public.eks-1-20-nr-prod-trial.srv.lystit.comIn scope2026-11-14
rpubelb.eks-1-20-nr-prod-trial.srv.lystit.comIn scope2026-11-14
analytics-gif-http-public-alb.eks-1-20.srv.lystit.comIn scope2026-11-14
cloudflare.eks-1-20.srv.lystit.comIn scope2026-11-14
intalb.eks-1-20.srv.lystit.comIn scope2026-11-14
intelb.eks-1-20.srv.lystit.comIn scope2026-11-14
internal.eks-1-20.srv.lystit.cominternalIn scope2026-11-14
intnlb.eks-1-20.srv.lystit.comIn scope2026-11-14
public.eks-1-20.srv.lystit.comIn scope2026-11-14
restricted-public.eks-1-20.srv.lystit.comIn scope2026-11-14
rpubelb.eks-1-20.srv.lystit.comIn scope2026-11-14
eks-1-22.srv.lystit.comIn scope2026-11-14
eks-1-22-test.srv.lystit.comtestIn scope2026-11-14
cloudflare.eks-1-22-test.srv.lystit.comtestIn scope2026-11-14
intalb.eks-1-22-test.srv.lystit.comtestIn scope2026-11-14
intelb.eks-1-22-test.srv.lystit.comtestIn scope2026-11-14
internal.eks-1-22-test.srv.lystit.cominternal, testIn scope2026-11-14
intnlb.eks-1-22-test.srv.lystit.comtestIn scope2026-11-14
public.eks-1-22-test.srv.lystit.comtestIn scope2026-11-14
restricted-public.eks-1-22-test.srv.lystit.comtestIn scope2026-11-14
rpubelb.eks-1-22-test.srv.lystit.comtestIn scope2026-11-14
analytics-gif-http-public-alb.eks-1-22.srv.lystit.comIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated