vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 1, 2026

Dec 29 to Jan 4, 2026 · published 2026-11-03

8 assets newly entered public bug-bounty scope in week 1 of 2026 (Dec 29 to Jan 4, 2026) on 6 programs: Robinhood Markets Bounty, X / xAI, Stiltsoft, Sky UK/ROI Vulnerability Disclosure Program and 2 more. Each asset was checked against its program's own scope history: 4 raw additions that week were assets put back after a removal and 1 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Sky UK/ROI Vulnerability Disclosure Program

Bugcrowd · up to $1,000 · 1 new asset

  • 1 scope item described in words
    • All internet facing Sky UK/ROI assets · url

Sky Italy Vulnerability Disclosure Program

Bugcrowd · up to $1,000 · 1 new asset

  • 1 scope item described in words
    • All internet facing Sky Italy assets · url

Sky DACH Vulnerability Disclosure Program

Bugcrowd · up to $1,000 · 1 new asset

  • 1 scope item described in words
    • All internet facing Sky DACH assets · url

New assets on existing programs

Robinhood Markets Bounty

HackerOne · 3 new assets

  • Id1406825640 · mobile · max severity critical · since 2026-01-02
  • net.bitstamp.app · mobile · max severity critical · since 2026-01-02
  • www.bitstamp.net · url · max severity critical · since 2026-01-02

Stiltsoft

Bugcrowd · up to $3,000 · 1 new asset

  • 1 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1214971/handy-macros-for-confluence-status-dropdown-formatting?hosting=datacenter · url

X / xAI

HackerOne · 1 new asset · 250 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Generic (34), Improper Authentication - Generic (31), Information Disclosure (23)

  • 1 named under *.x.com, already in scope
    • chat.x.com · url

all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.