New in bug bounty scope: week 12, 2026
51 assets newly entered public bug-bounty scope in week 12 of 2026 (Mar 16 to Mar 22, 2026) on 7 programs: T-Mobile, Recorded Future Public Managed Bug Bounty Engagement, Whatnot, Harman International Lifestyle Products & Services and 3 more. Each asset was checked against its program's own scope history: 61 raw additions that week were assets put back after a removal and 5 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
Recorded Future Public Managed Bug Bounty Engagement
https://api.recordedfuture.com· api · since 2026-03-20https://app.recordedfuture.com· url · since 2026-03-20https://geminiadvisory.io· url · since 2026-03-20https://hatching.io· url · since 2026-03-20https://id.recordedfuture.com· url · since 2026-03-20https://tria.ge· url · since 2026-03-20https://www.recordedfuture.com· url · since 2026-03-202 listed on apps.apple.com, play.google.com
https://apps.apple.com/us/app/recorded-future/id1435597894· mobilehttps://play.google.com/store/apps/details?id=com.recordedfuture.mobile&hl=en_US· mobile
Whatnot
*.whatnot.com· wildcard · max severity high · since 2026-03-17api.whatnot.com· url · max severity critical · since 2026-03-17auction-service.whatnot.com· url · max severity critical · since 2026-03-17com.whatnot_mobile· mobile · max severity critical · since 2026-03-17live-service.whatnot.com· url · max severity critical · since 2026-03-17www.whatnot.com· url · max severity critical · since 2026-03-171 scope item described in words
Whatnot: Shop, Sell, Connect· mobile
New assets on existing programs
T-Mobile
https://assets.development.amazon-tacticalplanner.com· url · since 2026-03-18https://assets.platform.blis.com· url · since 2026-03-18https://assets.platform.development.blis.com· url · since 2026-03-18https://assets.platform.rc.blis.com· url · since 2026-03-18https://creative.infinity.blismedia.com· url · since 2026-03-18https://development.wmaudience.com· url · since 2026-03-18https://imply-pivot.blis.com· url · since 2026-03-18https://imply-pivot.test.blis.com· url · since 2026-03-18https://imply.internal.platform.blis.com· url · since 2026-03-18https://imply.platform.blis.com· url · since 2026-03-18https://imply.platform.development.blis.com· url · since 2026-03-18https://imply.platform.rc.blis.com· url · since 2026-03-18https://imply.test.blis.com· url · since 2026-03-18https://imply.wmaudience.com· url · since 2026-03-18https://internal.platform.blis.com· url · since 2026-03-18https://jenkins-github.gcp.blis.com· url · since 2026-03-18https://platform.blis.com· url · since 2026-03-18https://platform.blismedia.com· url · since 2026-03-18https://platform.development.blis.com· url · since 2026-03-18https://platform.development2.blis.com· url · since 2026-03-18https://platform.rc.blis.com· url · since 2026-03-18https://privacy.blismedia.com· url · since 2026-03-18https://rc.wmaudience.com· url · since 2026-03-18https://signature.blis.com· url · since 2026-03-18https://sitepixel.blis.com· url · since 2026-03-18- and 1 more
Harman International Lifestyle Products & Services
https://apis.onecloud.harman.com· api · since 2026-03-16https://bluetooth-events.onecloud.harman.com· api · since 2026-03-16https://edgeapis.onecloud.harman.com· api · since 2026-03-16https://events.onecloud.harman.com· api · since 2026-03-16https://ota.onecloud.harman.com· api · since 2026-03-16
OPPO
com.heytap.wallet· other · max severity critical · since 2026-03-19
Stripe
*.metronome.com· wildcard · max severity critical · since 2026-03-16
BitGo Mobile Apps Bug Bounty Engagement
2 listed on apps.apple.com, play.google.com
https://apps.apple.com/us/app/bitgo/id6739010408· mobilehttps://play.google.com/store/apps/details?id=com.bitgo.mobileapp· mobile
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.