- Top reward
- $5,000
- Top severity paid
- Critical
- Assets in scope
- 7
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $5,000
- for critical bugs.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Critical |
|
$5,000 |
| High |
|
$1,000 |
| Medium |
|
$300 |
| Low |
|
$100 |
- Safe harbor
-
Partial
Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
7 assets you may test, 1 excluded.
Wildcard domains 3
- *.lyst.co Critical
- *.lyst.com Critical
- *.lystit.com Critical
Web 2
- cdna.lystit.com Critical
- mobileapi.lystit.com Critical
Android apps 1
- com.lyst.lystapp Critical
iOS apps 1
- 597940518 Critical
Out of scope (1)
- help.lyst.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Lyst (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
You must only test against accounts that you have created.
-
You may register for accounts as long as you include the suffix **+hackerone** before the @ in your email address.
-
Do not try and evade this limit.
-
If you are banned due to excessive activity please halt requests and wait a short amount of time and the ban will be released automatically.
-
Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
-
Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
-
Only interact with accounts you own or with explicit permission of the account holder.
Not accepted
-
Denial of service
-
Spamming
-
Social engineering (including phishing) of Lyst staff or contractors
-
Any physical attempts against Lyst property or data centers
-
Username enumeration
-
Exposure of social features such as users saved items
-
Missing "best practices" without a clear demonstration of impact in our use case
-
CSRF on login/logout/other non-authenticated content
-
Missing headers
-
Secure and HTTPonly flags on cookies
-
crossdomain.xml misconfiguration without an exploit scenario
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 17 minutes ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
No technology is perfect, and Lyst believes that working with skilled security researchers across the globe is crucial in identifying weaknesses in any technology. If you believe you've found a security issue in our product or service, we encourage you to notify us. We welcome working with you to resolve the issue promptly.
Test Accounts
You must only test against accounts that you have created. You may register for accounts as long as you include the suffix +hackerone before the @ in your email address. For example [email protected].
You may be banned for registering accounts without this string in your email address.
Test Cards
We have 5 test cards to use. Note these are not real credit card numbers. All orders will not be processed.
- 4024007175579357
- 4916375378230974
- 4839456722548214
- 4556908228877498
- 4916736231570825
Use the address 921 Front St #100, San Francisco, CA 94111 for all of them.
Rate Limits and Bans
We enforce rate limiting on most of our website. This may result in your address being banned if you make more than around 160 requests per minute from a single IP address. Do not try and evade this limit.
If you are banned due to excessive activity please halt requests and wait a short amount of time and the ban will be released automatically.
Disclosure Policy
- Let us know as soon as possible upon discovery of a potential security issue, and we'll make every effort to quickly resolve the issue.
- Provide us a reasonable amount of time to resolve the issue before any disclosure to the public or a third-party.
- Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with explicit permission of the account holder.
Examples of vulnerabilities Lyst are particularly interested in hearing about
Authentication flaws Cross-site scripting (XSS) SQL Injection Cross-site request forgery (CSRF/XSRF) Mixed content scripts (scripts loaded over HTTP on an HTTPS page, blockable errors only) Server side code execution Privilege Escalation Authorization flaws/Access Control Bypasses (e.g. being able to perform security-sensitive actions as a Restricted User) Clickjacking on authenticated pages with sensitive state changes
Exclusions
While researching, we'd like to ask you to refrain from:
- Submitting reports on
help.lyst.com- we do not host this and issues here should be reported directly to @Zendesk instead. - Denial of service
- Spamming
- Social engineering (including phishing) of Lyst staff or contractors
- Any physical attempts against Lyst property or data centers
- Username enumeration
- Exposure of social features such as users saved items
- Missing "best practices" without a clear demonstration of impact in our use case
- CSRF on login/logout/other non-authenticated content
- Missing headers
- Secure and HTTPonly flags on cookies
- crossdomain.xml misconfiguration without an exploit scenario
Thank you for helping keep Lyst and our users safe!