New in bug bounty scope: week 8, 2026

Feb 16 to Feb 22, 2026 · published 2026-11-03

13 assets newly entered public bug-bounty scope in week 8 of 2026 (Feb 16 to Feb 22, 2026) on 6 programs: Fireblocks MPC Managed Bug Bounty Engagement, Arlo Cash Rewards, Elastic, Spotify and 2 more. Each asset was checked against its program's own scope history: 0 raw additions that week were assets put back after a removal and 1 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Fireblocks MPC Managed Bug Bounty Engagement

Bugcrowd · up to $150,000 · 1 new asset

• https://github.com/fireblocks/mpc-lib · other · since 2026-02-19

AppFox

Bugcrowd · up to $1,500 · 5 new assets

• 5 listed on marketplace.atlassian.com

  • https://marketplace.atlassian.com/apps/1216387/approvals-for-confluence?hosting=cloud · url
  • https://marketplace.atlassian.com/apps/1217194/optimizer-for-jira-cleaner-for-jira?hosting=cloud · url
  • https://marketplace.atlassian.com/apps/1218474/compliance-for-confluence?hosting=cloud · url
  • https://marketplace.atlassian.com/apps/1222276/workflows-for-confluence?hosting=cloud · url
  • https://marketplace.atlassian.com/apps/1237517/captionizer-ai-image-analyzer · url

codeclou GmbH

Bugcrowd · up to $1,500 · 4 new assets

• 4 listed on marketplace.atlassian.com

  • https://marketplace.atlassian.com/apps/1211159/advanced-codeblocks-for-confluence/version-history · url
  • https://marketplace.atlassian.com/apps/1211159/advanced-codeblocks-for-confluence?hosting=cloud · url
  • https://marketplace.atlassian.com/apps/1211159/advanced-codeblocks-for-confluence?hosting=datacenter&tab=overview · url
  • https://marketplace.atlassian.com/apps/1212096/customfield-editor-for-jira?hosting=cloud&tab=overview · url

New assets on existing programs

Arlo Cash Rewards

Bugcrowd · up to $4,500 · 1 new asset

• *.arlocloud.com · url · since 2026-02-16

Elastic

HackerOne · 1 new asset · 20 publicly disclosed reports, most often: Privilege Escalation (3), Cross-site Scripting (XSS) - Stored (3), Improper Access Control - Generic (3)

• *.ela.st · wildcard · max severity critical · since 2026-02-19

Spotify

HackerOne · 1 new asset

• https://github.com/backstage/backstage · source · max severity medium · since 2026-02-19

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.