New in bug bounty scope: week 14, 2026
24 assets newly entered public bug-bounty scope in week 14 of 2026 (Mar 30 to Apr 5, 2026) on 4 programs: Opera Public Bug Bounty, 1win, OSL Managed Public Bug Bounty Engagement, Early Warning. Each asset was checked against its program's own scope history: 9 raw additions that week were assets put back after a removal and 13 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
1win
1w.cash· url · max severity critical · since 2026-04-041w.run· url · max severity critical · since 2026-04-041win.com· url · max severity critical · since 2026-04-04Deposit/Withdraw· other · max severity critical · since 2026-04-04https://1win.com/betting· url · max severity critical · since 2026-04-04https://1win.com/casino· url · max severity critical · since 2026-04-04
OSL Managed Public Bug Bounty Engagement
https://www.osl.com/en· url · since 2026-03-31https://www.osl.com/hk-en· url · since 2026-03-312 listed on apps.apple.com, play.google.com
https://apps.apple.com/es/app/osl-buy-bitcoin-crypto/id6743699672· mobilehttps://play.google.com/store/apps/details?id=com.oslmobile.global· mobile
New assets on existing programs
Opera Public Bug Bounty
*.adx.opera.com· api · since 2026-03-30*.apexscores.io· api · since 2026-03-30*.opr.news· api · since 2026-03-30*.osite99.com· api · since 2026-03-30*.rtbscale.com· api · since 2026-03-30*.savi.xyz· api · since 2026-03-30https://auth-adx.op-mobile.opera.com· url · since 2026-03-30https://cms.adx.opera.com· url · since 2026-03-30https://ofa.adx.opera.com· url · since 2026-03-30https://ofp.adx.opera.com· url · since 2026-03-30https://operaneon.com· url · since 2026-03-302 listed on apps.apple.com
https://apps.apple.com/pl/app/opera-gx/id1559740799· mobilehttps://apps.apple.com/us/app/opera-ai-browser-with-vpn/id1411869974· mobile
Early Warning
www.certos.com· url · max severity critical · since 2026-04-04
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.