New in bug bounty scope: week 6, 2026

Feb 2 to Feb 8, 2026 · published 2026-11-03

325 assets newly entered public bug-bounty scope in week 6 of 2026 (Feb 2 to Feb 8, 2026) on 10 programs: Watsons, Marionnaud, Kruidvat, ICI PARIS XL and 6 more. Each asset was checked against its program's own scope history: 1 raw additions that week were assets put back after a removal and 0 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Watsons

Intigriti · up to $8,500 · 122 new assets

*.drogas.lt · wildcard · since 2026-02-03
*.drogas.lv · wildcard · since 2026-02-03
*.fortress.com.hk · wildcard · since 2026-02-03
*.lookatme.com.ph · wildcard · since 2026-02-03
*.moneyback.com.hk · wildcard · since 2026-02-03
*.parknshop.com · wildcard · since 2026-02-03
*.pns.hk · wildcard · since 2026-02-03
*.watsons.co.id · wildcard · since 2026-02-03
*.watsons.co.th · wildcard · since 2026-02-03
*.watsons.com.hk · wildcard · since 2026-02-03
*.watsons.com.my · wildcard · since 2026-02-03
*.watsons.com.ph · wildcard · since 2026-02-03
*.watsons.com.sg · wildcard · since 2026-02-03
*.watsons.com.tr · wildcard · since 2026-02-03
*.watsons.com.tw · wildcard · since 2026-02-03
*.watsons.vn · wildcard · since 2026-02-03
adayevrak.watsons.com.tr · url · since 2026-02-03
api.drogas.lt · url · max severity Tier 1 · since 2026-02-03
api.drogas.lv · url · max severity Tier 1 · since 2026-02-03
api.fortress.com.hk · url · max severity Tier 1 · since 2026-02-03
api.lookatme.com.ph · url · max severity Tier 1 · since 2026-02-03
api.pns.hk · url · max severity Tier 1 · since 2026-02-03
api.watsons.co.id · url · max severity Tier 1 · since 2026-02-03
api.watsons.co.th · url · max severity Tier 1 · since 2026-02-03
api.watsons.com.hk · url · max severity Tier 1 · since 2026-02-03
and 67 more
30 scope items described in words
- Drogas Latvia Android · mobile
- Drogas Latvia iOS · mobile
- Drogas Lithuania Android · mobile
- Drogas Lithuania iOS · mobile
- Fortress Hong Kong Android · mobile
- Fortress Hong Kong iOS · mobile
- LookAtMe Philippines Android · mobile
- LookAtMe Philippines iOS · mobile
- Moneyback Android · mobile
- Moneyback iOS · mobile
- PNS Android · mobile
- PNS iOS · mobile
- Watsons Hong Kong Android · mobile
- Watsons Hong Kong iOS · mobile
- Watsons Indonesia Android · mobile
- Watsons Indonesia iOS · mobile
- Watsons Malaysia Android · mobile
- Watsons Malaysia iOS · mobile
- Watsons Philippines Android · mobile
- Watsons Philippines iOS · mobile
- Watsons Singapore Android · mobile
- Watsons Singapore iOS · mobile
- Watsons Taiwan Android · mobile
- Watsons Taiwan iOS · mobile
- Watsons Thailand Android · mobile
- Watsons Thailand iOS · mobile
- Watsons Turkey Android · mobile
- Watsons Turkey iOS · mobile
- Watsons Vietnam Android · mobile
- Watsons Vietnam iOS · mobile

Marionnaud

Intigriti · up to $8,500 · 74 new assets

*.marionnaud.at · wildcard · since 2026-02-03
*.marionnaud.ch · wildcard · since 2026-02-03
*.marionnaud.com · wildcard · since 2026-02-03
*.marionnaud.cz · wildcard · since 2026-02-03
*.marionnaud.de · wildcard · since 2026-02-03
*.marionnaud.es · wildcard · since 2026-02-03
*.marionnaud.fr · wildcard · since 2026-02-03
*.marionnaud.hu · wildcard · since 2026-02-03
*.marionnaud.it · wildcard · since 2026-02-03
*.marionnaud.paris · wildcard · since 2026-02-03
*.marionnaud.ro · wildcard · since 2026-02-03
*.marionnaud.sk · wildcard · since 2026-02-03
api.marionnaud.at · url · max severity Tier 1 · since 2026-02-03
api.marionnaud.ch · url · max severity Tier 1 · since 2026-02-03
api.marionnaud.cz · url · max severity Tier 2 · since 2026-02-03
api.marionnaud.fr · url · max severity Tier 1 · since 2026-02-03
api.marionnaud.hu · url · max severity Tier 2 · since 2026-02-03
api.marionnaud.it · url · max severity Tier 1 · since 2026-02-03
api.marionnaud.ro · url · max severity Tier 2 · since 2026-02-03
api.marionnaud.sk · url · max severity Tier 2 · since 2026-02-03
app.marionnaud.at · url · max severity Tier 1 · since 2026-02-03
app.marionnaud.ch · url · max severity Tier 1 · since 2026-02-03
app.marionnaud.cz · url · max severity Tier 2 · since 2026-02-03
app.marionnaud.fr · url · max severity Tier 1 · since 2026-02-03
app.marionnaud.hu · url · max severity Tier 2 · since 2026-02-03
and 33 more
16 scope items described in words
- Marionnaud Austria Android · mobile
- Marionnaud Austria iOS · mobile
- Marionnaud Czech Republic Android · mobile
- Marionnaud Czech Republic iOS · mobile
- Marionnaud France Android · mobile
- Marionnaud France iOS · mobile
- Marionnaud Hungary Android · mobile
- Marionnaud Hungary iOS · mobile
- Marionnaud Italy Android · mobile
- Marionnaud Italy iOS · mobile
- Marionnaud Romania Android · mobile
- Marionnaud Romania iOS · mobile
- Marionnaud Slovakia Android · mobile
- Marionnaud Slovakia iOS · mobile
- Marionnaud Switzerland Android · mobile
- Marionnaud Switzerland iOS · mobile

Kruidvat

Intigriti · up to $8,500 · 44 new assets

*.kruidvat.be · wildcard · since 2026-02-03
*.kruidvat.nl · wildcard · since 2026-02-03
*.kruidvatkids.nl · wildcard · since 2026-02-03
*.prijsmepper.nl · wildcard · since 2026-02-03
*.trekpleister.nl · wildcard · since 2026-02-03
campaign.kruidvat.be · url · since 2026-02-03
campaign.kruidvat.nl · url · since 2026-02-03
campaign.trekpleister.nl · url · since 2026-02-03
cewe.kruidvat.be · url · since 2026-02-03
cewe.kruidvat.nl · url · since 2026-02-03
depliantdejouets.kruidvat.be · url · since 2026-02-03
digital.kruidvat.be · url · since 2026-02-03
digital.kruidvat.nl · url · since 2026-02-03
ecom-data.kruidvat.be · url · since 2026-02-03
ecom-data.kruidvat.nl · url · since 2026-02-03
ecom-data.trekpleister.nl · url · since 2026-02-03
ecom-static.kruidvat.be · url · since 2026-02-03
ecom-static.kruidvat.nl · url · since 2026-02-03
folder.kruidvat.be · url · since 2026-02-03
folder.kruidvat.nl · url · since 2026-02-03
folder.trekpleister.nl · url · since 2026-02-03
foto.kruidvat.be · url · since 2026-02-03
foto.kruidvat.nl · url · since 2026-02-03
fotoservice.kruidvat.be · url · since 2026-02-03
fotoservice.kruidvat.nl · url · since 2026-02-03
and 15 more
4 scope items described in words
- Kruidvat BE Android · mobile
- Kruidvat BE iOS · mobile
- Kruidvat NL Android · mobile
- Kruidvat NL iOS · mobile

ICI PARIS XL

Intigriti · up to $8,500 · 37 new assets

*.iciparisxl.be · wildcard · since 2026-02-03
*.iciparisxl.lu · wildcard · since 2026-02-03
*.iciparisxl.nl · wildcard · since 2026-02-03
*.pourvous.nl · wildcard · since 2026-02-03
api.iciparisxl.be · url · max severity Tier 1 · since 2026-02-03
api.iciparisxl.lu · url · max severity Tier 1 · since 2026-02-03
api.iciparisxl.nl · url · max severity Tier 1 · since 2026-02-03
app.iciparisxl.be · url · max severity Tier 1 · since 2026-02-03
app.iciparisxl.lu · url · max severity Tier 1 · since 2026-02-03
app.iciparisxl.nl · url · max severity Tier 1 · since 2026-02-03
beauty-and-you.iciparisxl.nl · url · since 2026-02-03
campagne.iciparisxl.be · url · since 2026-02-03
campagne.iciparisxl.lu · url · since 2026-02-03
campagne.iciparisxl.nl · url · since 2026-02-03
edition.iciparisxl.nl · url · since 2026-02-03
folder.iciparisxl.nl · url · since 2026-02-03
folders.iciparisxl.nl · url · since 2026-02-03
media.iciparisxl.be · url · max severity Tier 1 · since 2026-02-03
media.iciparisxl.lu · url · max severity Tier 1 · since 2026-02-03
media.iciparisxl.nl · url · max severity Tier 1 · since 2026-02-03
newsletter-feedback.iciparisxl.nl · url · since 2026-02-03
newsletter.iciparisxl.nl · url · since 2026-02-03
service.iciparisxl.nl · url · since 2026-02-03
servicefr.iciparisxl.be · url · since 2026-02-03
servicefr.iciparisxl.lu · url · since 2026-02-03
and 10 more
2 scope items described in words
- ICI Paris XL Android · mobile
- ICI Paris XL iOS · mobile

MediaMarktSaturn Bug Bounty Program

YesWeHack · up to $ 4,000 · 31 new assets

https://www.mediamarkt.at · url · since 2026-02-02
https://www.mediamarkt.be · url · since 2026-02-02
https://www.mediamarkt.ch · url · since 2026-02-02
https://www.mediamarkt.com.tr · url · since 2026-02-02
https://www.mediamarkt.de · url · since 2026-02-02
https://www.mediamarkt.es · url · since 2026-02-02
https://www.mediamarkt.hu · url · since 2026-02-02
https://www.mediamarkt.nl · url · since 2026-02-02
https://www.mediamarkt.pl · url · since 2026-02-02
https://www.mediaworld.it · url · since 2026-02-02
https://www.saturn.de · url · since 2026-02-02
20 listed on apps.apple.com, play.google.com
- https://apps.apple.com/at/app/mediamarkt-%C3%B6sterreich/id583300669 · mobile
- https://apps.apple.com/be/app/mediamarkt-belgi%C3%AB/id958993034 · mobile
- https://apps.apple.com/ch/app/media-markt-schweiz/id1169043480 · mobile
- https://apps.apple.com/de/app/mediamarkt-deutschland/id386304604 · mobile
- https://apps.apple.com/de/app/saturn-deutschland/id557562682 · mobile
- https://apps.apple.com/es/app/mediamarkt-comprar-online/id1438532508 · mobile
- https://apps.apple.com/it/app/mediaworld-app/id1076895831 · mobile
- https://apps.apple.com/nl/app/mediamarkt-nederland/id573907448 · mobile
- https://apps.apple.com/pl/app/mediamarkt-polska/id6470200706 · mobile
- https://apps.apple.com/tr/app/mediamarkt-t%C3%BCrkiye/id908956795 · mobile
- https://play.google.com/store/apps/details?id=at.com.media.markt · mobile
- https://play.google.com/store/apps/details?id=be.com.media.markt · mobile
- https://play.google.com/store/apps/details?id=ch.mediamarkt · mobile
- https://play.google.com/store/apps/details?id=com.media.markt · mobile
- https://play.google.com/store/apps/details?id=com.media.saturn · mobile
- https://play.google.com/store/apps/details?id=es.mediamarkt.app · mobile
- https://play.google.com/store/apps/details?id=it.mediamarket.mediaworld · mobile
- https://play.google.com/store/apps/details?id=nl.com.media.markt · mobile
- https://play.google.com/store/apps/details?id=pl.mediamarkt · mobile
- https://play.google.com/store/apps/details?id=tr.com.media.markt · mobile

The Perfume Shop

Intigriti · up to $8,500 · 10 new assets

*.theperfumeshop.com · wildcard · since 2026-02-03
api.theperfumeshop.com · url · max severity Tier 1 · since 2026-02-03
app.theperfumeshop.com · url · max severity Tier 1 · since 2026-02-03
campaign.theperfumeshop.com · url · since 2026-02-03
campaigns.theperfumeshop.com · url · since 2026-02-03
ecom-data.theperfumeshop.com · url · since 2026-02-03
media.theperfumeshop.com · url · max severity Tier 1 · since 2026-02-03
www.theperfumeshop.com · url · max severity Tier 1 · since 2026-02-03
2 scope items described in words
- The Perfume Shop Android · mobile
- The Perfume Shop iOS · mobile

New assets on existing programs

Crypto.com

HackerOne · 1 new asset

og.com · url · max severity critical · since 2026-02-04

Epic Games

HackerOne · 1 new asset

https://communities.epicgames.com · url · max severity critical · since 2026-02-03

BookBeat

YesWeHack · up to $ 2,000 · 2 new assets

2 listed on apps.apple.com, play.google.com
- https://apps.apple.com/se/app/bookbeat-audiobooks-e-books/id1056652614?l=en-GB · mobile
- https://play.google.com/store/apps/details?id=com.bookbeat.android&hl=en&pli=1 · mobile

Inditex

HackerOne · 3 new assets

3 scope items described in words
- Main corporate site · other
- Other related e-commerce services · other
- Recruitment services · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.