Skip to content
Connect AISign inSign up free

Bug bounty program

LY

Lyst

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.comAnalysed#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET request#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.uk#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open Redirection#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.com#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Root
Scope
Name suggests
First seen
Text file1,624 names
Subdomains of Lyst
NameScopeFirst seen
lyst-connect-pr-1336-admin-cloudflare-alb.eks-1-32.cztio.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1337-admin-cloudflare-alb.eks-1-32.cztio.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1338-admin-cloudflare-alb.eks-1-32.cztio.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1339-admin-cloudflare-alb.eks-1-32.cztio.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1340-admin-cloudflare-alb.eks-1-32.cztio.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1341-admin-cloudflare-alb.eks-1-32.cztio.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1342-admin-cloudflare-alb.eks-1-32.cztio.lystit.comadminIn scope2026-11-14
lyst-css-pr-69-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
lyst-css-pr-70-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
lyst-sse-pr-7-listen-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
lyst-sse-pr-8-listen-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
lyst-tracker-pr-94-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
lyst-tracker-pr-95-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
lyst-tracker-pr-96-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
lyst-tracker-pr-97-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
merchant-uploader-pr-1564-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
merchant-uploader-pr-1565-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
merchant-uploader-pr-1569-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
merchant-uploader-pr-1570-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
merchant-uploader-pr-1572-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
merchant-uploader-pr-1574-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
merchant-uploader-pr-1576-web-cloudflare-alb.eks-1-32.cztio.lystit.comNewIn scope2026-11-15
merchant-uploader-pr-1577-web-cloudflare-alb.eks-1-32.cztio.lystit.comNewIn scope2026-11-15
meryl-pr-173-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-173-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-174-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-174-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-175-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-175-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-176-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-176-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-177-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-177-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-178-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-178-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-179-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-179-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-180-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-180-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-181-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-181-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-182-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-182-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-183-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-183-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-184-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-184-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-185-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-185-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-186-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
meryl-pr-186-web-dedupe-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
mobile-api-pr-4113-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4178-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4184-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4185-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4186-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4188-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4190-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4191-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4192-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4193-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4194-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4195-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4196-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4198-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4199-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4200-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4201-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4202-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4203-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4204-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4205-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4206-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4207-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4208-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4209-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4210-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4211-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4212-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4213-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4214-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comapi, internalIn scope2026-11-14
mobile-api-pr-4217-web-private-cloudflare-alb.eks-1-32.cztio.lystit.comNewapi, internalIn scope2026-11-15
partner-dash-pr-476-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
partner-dash-pr-477-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
partner-dash-pr-478-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
partner-dash-pr-479-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
partner-dash-pr-480-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
partner-dash-pr-481-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
partner-dash-pr-482-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
partner-dash-pr-483-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
partner-dash-pr-484-web-cloudflare-alb.eks-1-32.cztio.lystit.comNewIn scope2026-11-15
pims-pr-1167-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
pims-pr-1232-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
pims-pr-1234-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
pims-pr-1235-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
pims-pr-1236-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
pims-pr-1237-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
pims-pr-1238-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
pims-pr-1239-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14
pims-pr-1240-web-cloudflare-alb.eks-1-32.cztio.lystit.comIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated