New in bug bounty scope: week 4, 2026

Jan 19 to Jan 25, 2026 · published 2026-11-03

17 assets newly entered public bug-bounty scope in week 4 of 2026 (Jan 19 to Jan 25, 2026) on 3 programs: Twilio, Anduril Industries, FanDuel. Each asset was checked against its program's own scope history: 17 raw additions that week were assets put back after a removal and 0 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Twilio

HackerOne · 10 new assets

• *.sip.*.twilio.com · wildcard · max severity critical · since 2026-01-21
• api.segment.io · api · max severity critical · since 2026-01-21
• api.twilio.com · api · max severity critical · since 2026-01-21
• app.segment.com · url · max severity critical · since 2026-01-21
• app.sendgrid.com · url · max severity critical · since 2026-01-21
• mc.sendgrid.com · url · max severity critical · since 2026-01-21
• sendgrid.com · url · max severity critical · since 2026-01-21
• signup.sendgrid.com · url · max severity critical · since 2026-01-21
• static*.twilio.com · wildcard · max severity critical · since 2026-01-21
• 1 scope item described in words

  • Any host/web property verified to be owned by Twilio et al. · other

Anduril Industries

HackerOne · 6 new assets

• *.anduril.au · wildcard · max severity critical · since 2026-01-20
• *.anduril.com · wildcard · max severity critical · since 2026-01-20
• *.anduril.com.au · wildcard · max severity critical · since 2026-01-20
• *.anduril.dev · wildcard · max severity critical · since 2026-01-20
• *.andurildev.au · wildcard · max severity critical · since 2026-01-20
• *.andurildev.com · wildcard · max severity critical · since 2026-01-20

New assets on existing programs

FanDuel

HackerOne · 1 new asset · 1 publicly disclosed report, most often: Man-in-the-Middle (1)

• *.tvg.com · wildcard · max severity critical · since 2026-01-21

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.