New in bug bounty scope: week 7, 2026

Feb 9 to Feb 15, 2026 · published 2026-11-03

16 assets newly entered public bug-bounty scope in week 7 of 2026 (Feb 9 to Feb 15, 2026) on 6 programs: Meesho, ExpressVPN - Bug Bounty Program, Automattic, Coinbase and 2 more. Each asset was checked against its program's own scope history: 28 raw additions that week were assets put back after a removal and 0 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Meesho

HackerOne · 10 new assets

• 1457958492 · mobile · max severity critical · since 2026-02-11
• admin.meeshosupply.com · url · max severity critical · since 2026-02-11
• affiliate.meesho.com · url · max severity critical · since 2026-02-11
• com.meesho.supply · mobile · max severity critical · since 2026-02-11
• com.valmo.valmo · mobile · max severity critical · since 2026-02-11
• prod.meeshoapi.com · api · max severity critical · since 2026-02-11
• superstoreapp.meesho.com · url · max severity high · since 2026-02-11
• supplier.meesho.com · url · max severity critical · since 2026-02-11
• www.meesho.com · url · max severity critical · since 2026-02-11
• www.valmo.in · url · max severity critical · since 2026-02-11

New assets on existing programs

ExpressVPN - Bug Bounty Program

YesWeHack · up to $ 2,500 · 1 new asset

• app.expressmailguard.com · url · since 2026-02-10

Automattic

HackerOne · 1 new asset · 166 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Stored (23), Cross-site Scripting (XSS) - Generic (20), Improper Authentication - Generic (11)

• wpscan.com · url · max severity high · since 2026-02-12

Coinbase

HackerOne · 1 new asset · 80 publicly disclosed reports, most often: Improper Authentication - Generic (15), Violation of Secure Design Principles (14), Information Disclosure (9)

• com.vilcsak.bitcoin2 · mobile · max severity critical · since 2026-02-09

Robinhood Markets Bounty

HackerOne · 2 new assets

• com.robinhood.global Android · mobile · max severity critical · since 2026-02-11
• 1 scope item described in words

  • Tier 3 · other

Logitech

HackerOne · 1 new asset · 15 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Stored (2), Cross-Site Request Forgery (CSRF) (2), Open Redirect (2)

• 1 named under *.logitech.io, already in scope

  • logiq.logitech.io · url

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.