New in bug bounty scope: week 13, 2026
89 assets newly entered public bug-bounty scope in week 13 of 2026 (Mar 23 to Mar 29, 2026) on 10 programs: Xiaomi, OPPO, eToro Managed Bug Bounty Engagement, Safety Bug Bounty and 6 more. Each asset was checked against its program's own scope history: 4 raw additions that week were assets put back after a removal and 2 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
eToro Managed Bug Bounty Engagement
https://com.etoro.openbook· other · since 2026-03-25https://com.etoro.wallet· other · since 2026-03-25https://delta.app· url · since 2026-03-25https://etoropartners.com· url · since 2026-03-25https://etorox.com· url · since 2026-03-25https://io.getdelta.android· mobile · since 2026-03-25https://io.getdelta.ios· mobile · since 2026-03-25
Safety Bug Bounty
*.openai.com· other · since 2026-03-25Other· other · since 2026-03-25https://openai.com/· url · since 2026-03-251 scope item described in words
Agentic Tools· other
Felix Health Managed Bug Bounty Engagement
https://bugcrowd.charm.felixforus.ca/home· url · since 2026-03-26https://bugcrowd.lucky.felixforus.ca· url · since 2026-03-26
Izymes
8 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1211303/workzone-pullrequest-workflow?hosting=cloud· otherhttps://marketplace.atlassian.com/apps/1211303/workzone-pullrequest-workflow?hosting=datacenter· otherhttps://marketplace.atlassian.com/apps/1211303/workzone-pullrequest-workflow?hosting=server· otherhttps://marketplace.atlassian.com/apps/1212840/reminders-for-bitbucket?hosting=datacenter· otherhttps://marketplace.atlassian.com/apps/1212840/reminders-for-bitbucket?hosting=server&tab=overview· otherhttps://marketplace.atlassian.com/apps/1215843/global-pull-request-organizr?hosting=datacenter· otherhttps://marketplace.atlassian.com/apps/1215843/global-pull-request-organizr?hosting=server· otherhttps://marketplace.atlassian.com/apps/1224025/ai-insights-for-jira-service-management?hosting=cloud· other
New assets on existing programs
Xiaomi
*.airstar-finance.com· wildcard · max severity critical · since 2026-03-25*.airstar.com· wildcard · max severity critical · since 2026-03-25*.airstarfinance.net· wildcard · max severity critical · since 2026-03-25*.aleenote.cn· wildcard · max severity critical · since 2026-03-25*.aleenote.com· wildcard · max severity critical · since 2026-03-25*.baoliyun.com· wildcard · max severity critical · since 2026-03-25*.duokan.com· wildcard · max severity critical · since 2026-03-25*.hongyuanib.com· wildcard · max severity critical · since 2026-03-25*.mi.cn· wildcard · max severity critical · since 2026-03-25*.mifile.cn· wildcard · max severity critical · since 2026-03-25*.migames.com· wildcard · max severity critical · since 2026-03-25*.miinsurtech.cn· wildcard · max severity critical · since 2026-03-25*.miinsurtech.com· wildcard · max severity critical · since 2026-03-25*.miinsurtech.net· wildcard · max severity critical · since 2026-03-25*.mijiayoupin.com· wildcard · max severity critical · since 2026-03-25*.mioffice.cn· wildcard · max severity critical · since 2026-03-25*.mios.cn· wildcard · max severity critical · since 2026-03-25*.miot-spec.org· wildcard · max severity critical · since 2026-03-25*.mipay.com· wildcard · max severity critical · since 2026-03-25*.mipay.net· wildcard · max severity critical · since 2026-03-25*.miui.cn· wildcard · max severity critical · since 2026-03-25*.oktukids.com· wildcard · max severity critical · since 2026-03-25*.openvela.com· wildcard · max severity critical · since 2026-03-25*.wali.com· wildcard · max severity critical · since 2026-03-25*.xiangkankeji.cn· wildcard · max severity critical · since 2026-03-25- and 12 more
OPPO
com.heytap.book· other · max severity critical · since 2026-03-24com.heytap.databaseengine· other · max severity critical · since 2026-03-24com.heytap.health.quickapp· other · max severity critical · since 2026-03-24com.heytap.heymelody· other · max severity critical · since 2026-03-24com.heytap.miniapp.sports· other · max severity critical · since 2026-03-24com.heytap.ocsp.client· other · max severity critical · since 2026-03-24com.heytap.reader· other · max severity critical · since 2026-03-24com.heytap.tas· other · max severity critical · since 2026-03-24com.heytap.wearable.breeno· other · max severity critical · since 2026-03-24com.heytap.wearable.browser· other · max severity critical · since 2026-03-24com.heytap.wearable.elves· other · max severity critical · since 2026-03-24com.heytap.wearable.healthassessment· other · max severity critical · since 2026-03-24com.heytap.wearable.market· other · max severity critical · since 2026-03-24com.heytap.wearable.research· other · max severity critical · since 2026-03-24com.heytap.wearable.themestore· other · max severity critical · since 2026-03-24com.oplus.accesscard· other · max severity critical · since 2026-03-24com.oplus.melody· other · max severity critical · since 2026-03-24com.oplus.studycenter· other · max severity critical · since 2026-03-24com.qpon.merchant· other · max severity critical · since 2026-03-24com.qpon.platform· other · max severity critical · since 2026-03-24com.shopai.apps· other · max severity critical · since 2026-03-24https://zhongbao-ear.heytap.com/· url · max severity critical · since 2026-03-24https://zhongbao.heytap.com/· url · max severity critical · since 2026-03-241 scope item described in words
Low Level Properties and Test environment· other
Recorded Future Public Managed Bug Bounty Engagement
https://securitytrails.com· url · since 2026-03-24
Visa
https://ebctest.cybersource.com/kms/· url · max severity critical · since 2026-03-27
AXIS OS
1 scope item described in words
AXIS OS· other
Flipkart
4 listed on apps.apple.com, play.google.com
https://apps.apple.com/in/app/flipkart-online-shopping-app/id742044692· urlhttps://apps.apple.com/in/app/myntra-fashion-shopping-app/id907394059· mobilehttps://play.google.com/store/apps/details?id=com.flipkart.android· urlhttps://play.google.com/store/apps/details?id=com.myntra.android· mobile
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.