Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.comAnalysed#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.ukAnalysed#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.com#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Subdomains of Lyst
NameScopeFirst seen
helloworld-pr-281-web-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
helloworld-pr-282-web-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-257-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-258-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-260-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-261-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-262-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-264-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-265-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-266-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-268-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-269-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-270-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-271-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-272-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
hr-sync-pr-273-web-public-cloudflare-alb.eks-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23127-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23336-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23560-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23574-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23578-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23585-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23599-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23607-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23624-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23627-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23628-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23629-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23630-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23631-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23632-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23635-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23636-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23637-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23638-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23639-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23643-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23644-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23645-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23646-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23647-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23648-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23649-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23650-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23651-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23652-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23653-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23654-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23655-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23667-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23668-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23669-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23670-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23671-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23673-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23674-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23675-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23677-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23678-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23679-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23682-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23683-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23684-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23685-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23686-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23688-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23689-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23690-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23695-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23696-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23697-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23698-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23699-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23700-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23701-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23702-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23703-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23705-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23706-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23707-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23708-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23709-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23710-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23711-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23712-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23713-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23714-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23715-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23717-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23718-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23720-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23721-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23722-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23723-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23724-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23725-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23727-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23728-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23729-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23730-web-cloudflare-alb.eks-website-1-32.cztio.lystit.comIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.