Bug bounty program
LY
Lyst
Most upvoted reports9
| Report | Weakness | Disclosed | Bounty | Votes |
|---|---|---|---|---|
| Subdomain takeover of storybook.lystit.comAnalysed#779442 | Access Control | 2020-01-22 | $1,000 | 163 |
| Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589 | Misconfiguration and Insecure Design | 2022-03-22 | – | 45 |
| SSRF at iris.lystit.comAnalysed#206894 | Server-Side Request Forgery | 2017-10-18 | – | 21 |
| CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953 | Cross-Site Request Forgery | 2017-09-28 | $150 | 19 |
| Site configured improperly at subdomain of lyst.co.ukAnalysed#208480 | Misconfiguration and Insecure Design | 2017-03-29 | $100 | 19 |
| [https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047 | Open Redirect | 2022-03-22 | – | 18 |
| DOM XSS on http://talks.lystit.com#1031644 | Cross-site Scripting | 2021-02-09 | $100 | 15 |
| Mixed Active content issue on https://www.lyst.com#207329 | Misconfiguration and Insecure Design | 2017-02-22 | – | 12 |
| Bypassing one-time checkout router page (revealing payment information)#271176 | Information Disclosure | 2018-05-10 | – | 12 |
Subdomains1,624
| Name | Scope | First seen |
|---|---|---|
| graphite.lystit.com | In scope | 2026-11-14 |
| hamster-tunnel.lystit.com | In scope | 2026-11-14 |
| helloworld-pr-200-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| helloworld-pr-200-web-cloudflare-alb-eks-1-26-preview.lystit.comstaging | In scope | 2026-11-14 |
| helloworld-pr-206-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| helloworld-pr-207-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| helloworld-pr-208-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| helloworld-pr-209-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| helloworld-pr-211-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| helloworld-pr-216-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| helloworld-pr-217-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| helloworld-web.lystit.com | In scope | 2026-11-14 |
| hr-sync.lystit.com | In scope | 2026-11-14 |
| hr-sync-pr-130-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| hr-sync-pr-136-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| hr-sync-pr-137-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| hr-sync-pr-139-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| hr-sync-pr-140-web-cloudflare-alb-eks-1-26.lystit.com | In scope | 2026-11-14 |
| test.hr-sync.hr-sync.lystit.comtest | In scope | 2026-11-14 |
| i18n-code-samples.lystit.com | In scope | 2026-11-14 |
| i18n-webhook-receiver.lystit.com | In scope | 2026-11-14 |
| images.lystit.com | In scope | 2026-11-14 |
| images-eu-west-1.lystit.com | In scope | 2026-11-14 |
| images-geo.lystit.com | In scope | 2026-11-14 |
| internal.lystit.cominternal | In scope | 2026-11-14 |
| jenkins-2019.lystit.comci | In scope | 2026-11-14 |
| jenkins-pr.lystit.comci | In scope | 2026-11-14 |
| jira.lystit.comtools | In scope | 2026-11-14 |
| jira-2020.lystit.comtools | In scope | 2026-11-14 |
| jira-backup.lystit.comdata, tools | In scope | 2026-11-14 |
| jira-internal.lystit.cominternal, tools | In scope | 2026-11-14 |
| jira-staging.lystit.comstaging, tools | In scope | 2026-11-14 |
| judy.lystit.com | In scope | 2026-11-14 |
| lap.lystit.com | In scope | 2026-11-14 |
| lap-preview.lystit.comstaging | In scope | 2026-11-14 |
| logs.lystit.commonitoring | In scope | 2026-11-14 |
| logs-direct.lystit.commonitoring | In scope | 2026-11-14 |
| logs-test.lystit.commonitoring, test | In scope | 2026-11-14 |
| loki.lystit.com | In scope | 2026-11-14 |
| loki-internal.lystit.cominternal | In scope | 2026-11-14 |
| lyst-analyst-test.lystit.comtest | In scope | 2026-11-14 |
| lyst-analyst-test-2.lystit.comtest | In scope | 2026-11-14 |
| lyst-connect-pr-1230-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1231-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1232-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1233-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1235-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1236-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1237-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1238-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1239-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1240-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1241-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1242-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1243-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1244-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1245-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1246-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1247-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1250-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1252-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1255-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1256-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1262-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1264-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1265-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1268-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-connect-pr-1269-admin-cloudflare-alb-eks-1-26.lystit.comadmin | In scope | 2026-11-14 |
| lyst-website-pr-21396-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21400-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21407-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21412-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21413-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21414-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21415-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21416-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21419-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21420-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21421-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21422-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21423-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21424-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21425-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21426-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21427-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21429-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21431-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21432-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21433-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21434-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21435-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21436-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21437-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21438-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21441-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21444-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21445-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21446-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21447-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
| lyst-website-pr-21448-web-cloudflare-alb-eks-website-1-26.lystit.com | In scope | 2026-11-14 |
1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.