New in bug bounty scope: week 15, 2026

Apr 6 to Apr 12, 2026 · published 2026-11-03

18 assets newly entered public bug-bounty scope in week 15 of 2026 (Apr 6 to Apr 12, 2026) on 7 programs: Gearset: Managed Bug Bounty, DECATHLON, Magic Eden, SAP Invitational Bug Bounty Program and 3 more. Each asset was checked against its program's own scope history: 11 raw additions that week were assets put back after a removal and 2 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

SecureFlag Marketplace Bug Bounty

Bugcrowd · up to $1,500 · 2 new assets

• 2 listed on marketplace.atlassian.com

  • https://marketplace.atlassian.com/apps/1226453/secureflag-knowledge-base?tab=overview&hosting=cloud · url
  • https://marketplace.atlassian.com/apps/1232491?tab=overview&hosting=cloud · url

New assets on existing programs

Gearset: Managed Bug Bounty

Bugcrowd · up to $6,000 · 2 new assets

• https://staging.claytonapp.com · url · since 2026-04-08
• https://staging.claytonapp.com/api · api · since 2026-04-08

DECATHLON

YesWeHack · up to $ 2,500 · 3 new assets

• https://(navigate|engage|checkout|internal|cached-api|api).shoppingapp.decathlon.com/* · api · since 2026-04-07
• 2 listed on apps.apple.com, play.google.com

  • https://apps.apple.com/fr/app/decathlon-shopping/id1168607403 · mobile
  • https://play.google.com/store/apps/details?id=com.decathlon.app · mobile

Magic Eden

HackerOne · 1 new asset

• api.dicey.com · url · max severity critical · since 2026-04-09

SAP Invitational Bug Bounty Program

Bugcrowd · up to $20,000 · 4 new assets

• 4 scope items described in words

  • SAP BusinessOne · url
  • SAP Signavio Process Intelligence · url
  • SAP Signavio Process Management · url
  • SAP WalkMe · url

Soteri Marketplace Bug Bounty

Bugcrowd · up to $4,500 · 5 new assets

• 5 listed on marketplace.atlassian.com

  • https://marketplace.atlassian.com/apps/1221399/security-for-bitbucket-enhanced-secret-scanner-by-soteri?hosting=datacenter&tab=overview · url
  • https://marketplace.atlassian.com/apps/1224167/security-for-confluence-enhanced-secret-scanner-by-soteri?hosting=cloud&tab=overview · url
  • https://marketplace.atlassian.com/apps/1224167/security-for-confluence-enhanced-secret-scanner-by-soteri?hosting=datacenter&tab=overview · url
  • https://marketplace.atlassian.com/apps/1229376/security-for-jira-enhanced-secret-scanner-by-soteri?hosting=cloud&tab=overview · url
  • https://marketplace.atlassian.com/apps/1229376/security-for-jira-enhanced-secret-scanner-by-soteri?hosting=datacenter&tab=overview · url

Automattic

HackerOne · 1 new asset · 166 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Stored (23), Cross-site Scripting (XSS) - Generic (20), Improper Authentication - Generic (11)

• 1 scope item described in words

  • WP Cloud · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.