New in bug bounty scope: week 10, 2026

Mar 2 to Mar 8, 2026 · published 2026-11-03

21 assets newly entered public bug-bounty scope in week 10 of 2026 (Mar 2 to Mar 8, 2026) on 4 programs: CLEAR, Visa, Cloudflare Public Bug Bounty, Magic Eden. Each asset was checked against its program's own scope history: 3 raw additions that week were assets put back after a removal and 1 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

CLEAR

HackerOne · 17 new assets

• authentication.clearme.com · url · max severity critical · since 2026-03-02
• clearme.atlassian.net · url · max severity high · since 2026-03-02
• clearme.com · url · max severity critical · since 2026-03-02
• com.clearme.Clear · other · max severity critical · since 2026-03-02
• com.clearme.clearapp · other · max severity critical · since 2026-03-02
• concierge.clearme.com · url · max severity critical · since 2026-03-02
• enroll.clearme.com · url · max severity critical · since 2026-03-02
• http://verified.clearme.com/dashboard · url · max severity critical · since 2026-03-02
• identity.clearme.com · url · max severity critical · since 2026-03-02
• ir.clearme.com · url · max severity critical · since 2026-03-02
• mobile.clearme.com · url · max severity critical · since 2026-03-02
• my.clearme.com · url · max severity critical · since 2026-03-02
• scan.clearme.com · url · max severity critical · since 2026-03-02
• verified.clearme.com · url · max severity critical · since 2026-03-02
• verified.clearme.com/v1/verification_sessions · api · max severity critical · since 2026-03-02
• web-edge.clearme.com · url · max severity critical · since 2026-03-02
• www.clearme.com · url · max severity critical · since 2026-03-02

New assets on existing programs

Visa

HackerOne · 2 new assets

• https://ebctest.cybersource.com/tech-partner-integration · url · max severity critical · since 2026-03-02
• https://ebctest.cybersource.com/notification-subscriptions · url · max severity critical · since 2026-03-04

Cloudflare Public Bug Bounty

HackerOne · 1 new asset · 48 publicly disclosed reports, most often: Improper Authentication - Generic (7), Improper Access Control - Generic (6), Client-Side Enforcement of Server-Side Security (5)

• https://github.com/cloudflare/vinext · source · max severity critical · since 2026-03-02

Magic Eden

HackerOne · 1 new asset

• dicey.com · url · max severity critical · since 2026-03-05

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.