vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 2, 2026

Jan 5 to Jan 11, 2026 · published 2026-11-03

10 assets newly entered public bug-bounty scope in week 2 of 2026 (Jan 5 to Jan 11, 2026) on 5 programs: Banco Plata, The Trade Desk, Bumble, inDrive and 1 more. Each asset was checked against its program's own scope history: 190 raw additions that week were assets put back after a removal and 7 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Banco Plata

HackerOne · 3 new assets

  • *.platacard.mx · wildcard · max severity critical · since 2026-01-08
  • dif.tech.plata · mobile · max severity critical · since 2026-01-08
  • id6443932656 · mobile · max severity critical · since 2026-01-08

New assets on existing programs

The Trade Desk

Bugcrowd · up to $5,000 · 2 new assets

  • https://secure-signals-client-side-integ.uidapi.com/ · url · since 2026-01-05
  • https://secure-signals-react-integ.uidapi.com · url · since 2026-01-05

Bumble

HackerOne · 2 new assets · 36 publicly disclosed reports, most often: Information Disclosure (7), Violation of Secure Design Principles (5), Improper Authentication - Generic (4)

  • app.geneva-staging.com · url · max severity critical · since 2026-01-05
  • com.genevachat.staging · other · max severity critical · since 2026-01-05

inDrive

HackerOne · 2 new assets · 18 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Reflected (5), Business Logic Errors (3), Information Disclosure (3)

  • invisionu.education · url · max severity critical · since 2026-01-09
  • 1 named under *.indrive.com, already in scope
    • delivery-webview.indrive.com · url

Visa

HackerOne · 1 new asset

  • https://ebctest.cybersource.com/pts/v1/transaction-batch-upload · url · max severity critical · since 2026-01-06

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.