Skip to content

Bug bounty program

Platform
HackerOne
Bounties
Pays
Assets in scope
7
Disclosed reports
9
Subdomains
1,624

Most upvoted reports9

Most upvoted reports of Lyst
ReportWeaknessDisclosedBountyVotes
Subdomain takeover of storybook.lystit.comAnalysed#779442Access Control2020-01-22$1,000163
Web Cache poisoning attack leads to User information Disclosure and moreAnalysed#631589Misconfiguration and Insecure Design2022-03-22–45
SSRF at iris.lystit.com#206894Server-Side Request Forgery2017-10-18–21
CSRF - Adding unlimited number of saved items via GET request#205953Cross-Site Request Forgery2017-09-28$15019
Site configured improperly at subdomain of lyst.co.uk#208480Misconfiguration and Insecure Design2017-03-29$10019
[https://█████████/]&&[https://█████████/] Open Redirection#537047Open Redirect2022-03-22–18
DOM XSS on http://talks.lystit.com#1031644Cross-site Scripting2021-02-09$10015
Mixed Active content issue on https://www.lyst.com#207329Misconfiguration and Insecure Design2017-02-22–12
Bypassing one-time checkout router page (revealing payment information)#271176Information Disclosure2018-05-10–12

Subdomains1,624

Subdomains of Lyst
NameScopeFirst seen
news-staging.lyst.comstagingIn scope2026-11-14
alpha.lystit.comstagingIn scope2026-11-14
ci3-beta.lystit.comstagingIn scope2026-11-14
confluence-staging.lystit.comstaging, toolsIn scope2026-11-14
shopping-cart-pr-1494-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1494-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1496-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1496-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1498-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1498-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1500-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1500-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1502-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1502-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1503-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1503-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1506-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1506-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1508-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1508-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1510-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1510-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1511-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1511-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1513-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1513-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1514-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1514-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1515-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1515-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1516-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1516-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1517-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1517-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1518-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1518-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1519-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1519-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1520-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1521-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1521-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1522-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1522-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1523-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1523-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1524-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1524-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1525-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1526-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1526-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1527-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1527-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1528-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1528-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1529-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1529-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1530-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1530-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1531-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1531-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1532-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1532-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1533-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1533-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1534-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1534-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1535-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1535-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1536-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1536-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1537-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1538-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1538-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1540-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1540-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1541-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1541-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1542-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1542-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1543-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1543-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1544-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1544-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1545-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1545-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1546-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1546-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1547-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1547-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1548-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1548-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1549-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1549-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1550-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1550-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1552-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1552-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1553-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1553-staging-web-us-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14
shopping-cart-pr-1554-staging-web-uk-cloudflare-alb.eks-1-32.cztio.lystit.comstagingIn scope2026-11-14

1,623 names are covered by the program's own scope; 26 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.