Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.comAnalysed#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.ukAnalysed#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.com#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Subdomains of Lyst
NameScopeFirst seen
lyst-website-pr-23719-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23720-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23721-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23722-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23723-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23724-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23725-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23727-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23728-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23729-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23730-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23731-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23732-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23733-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23734-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23735-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23736-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23737-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23738-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23739-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23740-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23741-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23742-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23743-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23744-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23745-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23746-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23748-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23749-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23750-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23751-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23753-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23754-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23755-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23756-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23757-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23758-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23759-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23760-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23761-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23762-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23763-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23764-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23765-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23766-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23767-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23769-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23770-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23771-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23772-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23773-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23774-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23775-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23776-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23777-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23778-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23779-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23780-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23781-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23782-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23783-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23784-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23786-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comNewIn scope2026-11-15
lyst-website-pr-23787-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23788-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comIn scope2026-11-14
lyst-website-pr-23789-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comNewIn scope2026-11-15
lyst-website-pr-23790-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comNewIn scope2026-11-15
lyst-website-pr-23791-web-cloudflare-alb.eks-website-1-36.cztio.lystit.comNewIn scope2026-11-15
dashboard-eks-1-32.lystit.comadminIn scope2026-11-14
dashboard-eks-1-36.lystit.comadminIn scope2026-11-14
dashboard-eks-ci-1-32.lystit.comadmin, ciIn scope2026-11-14
dashboard-eks-website-1-32.lystit.comadminIn scope2026-11-14
dashboard-eks-website-1-36.lystit.comadminIn scope2026-11-14
data-dictionary.lystit.comIn scope2026-11-14
dbt-docs.lystit.comIn scope2026-11-14
designer-moderation.lystit.comIn scope2026-11-14
dex.lystit.comIn scope2026-11-14
disco-evals.lystit.comIn scope2026-11-14
docs.lystit.comIn scope2026-11-14
dogs.lystit.comIn scope2026-11-14
drome.lystit.comIn scope2026-11-14
engineering.lystit.comIn scope2026-11-14
feedfetcher.lystit.comIn scope2026-11-14
feeds-fashionclip-opensearch-dashboards.lystit.comIn scope2026-11-14
feeds-opensearch-dashboards.lystit.comIn scope2026-11-14
feeds-staging-opensearch-dashboards.lystit.comstagingIn scope2026-11-14
git.lystit.comgitIn scope2026-11-14
reply.git.lystit.comgitIn scope2026-11-14
goc-h70kpm5usy2ugk11ttdj8tmtynllg9wz.lystit.comIn scope2026-11-14
goldilocks-eks-1-32.lystit.comIn scope2026-11-14
goldilocks-eks-1-36.lystit.comIn scope2026-11-14
goldilocks-eks-ci-1-32.lystit.comciIn scope2026-11-14
goldilocks-eks-website-1-32.lystit.comIn scope2026-11-14
goldilocks-eks-website-1-36.lystit.comIn scope2026-11-14
grafana.lystit.commonitoringIn scope2026-11-14
grafana-eks-1-32.lystit.commonitoringIn scope2026-11-14
grafana-eks-1-36.lystit.commonitoringIn scope2026-11-14
grafana-eks-ci-1-32.lystit.comci, monitoringIn scope2026-11-14
grafana-eks-website-1-32.lystit.commonitoringIn scope2026-11-14
grafana-eks-website-1-36.lystit.commonitoringIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.