New in bug bounty scope: week 5, 2026

Jan 26 to Feb 1, 2026 · published 2026-11-03

17 assets newly entered public bug-bounty scope in week 5 of 2026 (Jan 26 to Feb 1, 2026) on 4 programs: inDrive, Privy (Bounty), Bykea, Databricks. Each asset was checked against its program's own scope history: 0 raw additions that week were assets put back after a removal and 0 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New assets on existing programs

inDrive

HackerOne · 6 new assets · 18 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Reflected (5), Business Logic Errors (3), Information Disclosure (3)

• api.ryadom.kz · url · max severity critical · since 2026-01-28
• job.ryadom.kz · url · max severity critical · since 2026-01-28
• landing.ryadom.kz · url · max severity critical · since 2026-01-28
• ryadom.kz · url · max severity critical · since 2026-01-28
• sso.ryadom.kz · url · max severity critical · since 2026-01-28
• web.ryadom.kz · url · max severity critical · since 2026-01-28

Privy (Bounty)

HackerOne · 9 new assets

• api.privy.io · url · max severity critical · since 2026-01-27
• home.privy.io · url · max severity critical · since 2026-01-27
• recovery.privy.io · url · max severity critical · since 2026-01-27
• 5 listed on www.npmjs.com

  • https://www.npmjs.com/package/@privy-io/cross-app-connect · other
  • https://www.npmjs.com/package/@privy-io/cross-app-provider · other
  • https://www.npmjs.com/package/@privy-io/expo · other
  • https://www.npmjs.com/package/@privy-io/js-sdk-core · other
  • https://www.npmjs.com/package/@privy-io/wagmi · other
• 1 scope item described in words

  • @privy-io controlled namespace dependencies · other

Bykea

HackerOne · 1 new asset · 11 publicly disclosed reports, most often: Insecure Direct Object Reference (IDOR) (5), Business Logic Errors (3), Improper Access Control - Generic (1)

• 1 named under *.bykea.net, already in scope

  • tomoe.bykea.net · url

Databricks

HackerOne · 1 new asset

• 1 scope item described in words

  • Open Scope · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.