Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.comAnalysed#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET requestAnalysed#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.ukAnalysed#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open RedirectionAnalysed#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.com#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Subdomains of Lyst
NameScopeFirst seen
graphite.lystit.comIn scope2026-11-14
hamster-tunnel.lystit.comIn scope2026-11-14
helloworld-pr-200-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
helloworld-pr-200-web-cloudflare-alb-eks-1-26-preview.lystit.comstagingIn scope2026-11-14
helloworld-pr-206-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
helloworld-pr-207-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
helloworld-pr-208-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
helloworld-pr-209-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
helloworld-pr-211-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
helloworld-pr-216-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
helloworld-pr-217-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
helloworld-web.lystit.comIn scope2026-11-14
hr-sync.lystit.comIn scope2026-11-14
hr-sync-pr-130-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
hr-sync-pr-136-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
hr-sync-pr-137-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
hr-sync-pr-139-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
hr-sync-pr-140-web-cloudflare-alb-eks-1-26.lystit.comIn scope2026-11-14
test.hr-sync.hr-sync.lystit.comtestIn scope2026-11-14
i18n-code-samples.lystit.comIn scope2026-11-14
i18n-webhook-receiver.lystit.comIn scope2026-11-14
images.lystit.comIn scope2026-11-14
images-eu-west-1.lystit.comIn scope2026-11-14
images-geo.lystit.comIn scope2026-11-14
internal.lystit.cominternalIn scope2026-11-14
jenkins-2019.lystit.comciIn scope2026-11-14
jenkins-pr.lystit.comciIn scope2026-11-14
jira.lystit.comtoolsIn scope2026-11-14
jira-2020.lystit.comtoolsIn scope2026-11-14
jira-backup.lystit.comdata, toolsIn scope2026-11-14
jira-internal.lystit.cominternal, toolsIn scope2026-11-14
jira-staging.lystit.comstaging, toolsIn scope2026-11-14
judy.lystit.comIn scope2026-11-14
lap.lystit.comIn scope2026-11-14
lap-preview.lystit.comstagingIn scope2026-11-14
logs.lystit.commonitoringIn scope2026-11-14
logs-direct.lystit.commonitoringIn scope2026-11-14
logs-test.lystit.commonitoring, testIn scope2026-11-14
loki.lystit.comIn scope2026-11-14
loki-internal.lystit.cominternalIn scope2026-11-14
lyst-analyst-test.lystit.comtestIn scope2026-11-14
lyst-analyst-test-2.lystit.comtestIn scope2026-11-14
lyst-connect-pr-1230-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1231-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1232-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1233-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1235-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1236-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1237-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1238-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1239-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1240-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1241-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1242-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1243-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1244-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1245-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1246-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1247-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1250-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1252-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1255-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1256-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1262-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1264-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1265-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1268-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-connect-pr-1269-admin-cloudflare-alb-eks-1-26.lystit.comadminIn scope2026-11-14
lyst-website-pr-21396-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21400-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21407-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21412-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21413-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21414-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21415-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21416-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21419-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21420-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21421-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21422-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21423-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21424-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21425-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21426-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21427-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21429-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21431-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21432-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21433-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21434-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21435-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21436-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21437-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21438-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21441-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21444-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21445-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21446-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21447-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14
lyst-website-pr-21448-web-cloudflare-alb-eks-website-1-26.lystit.comIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.