New in bug bounty scope: week 16, 2026
12 assets newly entered public bug-bounty scope in week 16 of 2026 (Apr 13 to Apr 19, 2026) on 6 programs: Opera Public Bug Bounty, Wyze Bug Bounty, 23andMe Bug Bounty, Crypto.com and 2 more. Each asset was checked against its program's own scope history: 6 raw additions that week were assets put back after a removal and 5 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
Colined
6 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1215414/pivot-report?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1215414/pivot-report?hosting=datacenter&tab=overview· urlhttps://marketplace.atlassian.com/apps/1215414/pivot-report?hosting=server&tab=overview· urlhttps://marketplace.atlassian.com/apps/1216516/worklogs-report?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1216516/worklogs-report?hosting=datacenter&tab=overview· urlhttps://marketplace.atlassian.com/apps/1216516/worklogs-report?hosting=server&tab=overview· url
New assets on existing programs
Opera Public Bug Bounty
*.apexnews.com· api · since 2026-04-131 listed on play.google.com
https://play.google.com/store/apps/details?id=com.opera.minipay· mobile
Wyze Bug Bounty
https://www.wyze.com/products/wyze-cam· device · since 2026-04-16
23andMe Bug Bounty
23andmeresearchinstitute.org· url · max severity critical · since 2026-04-15
Crypto.com
1 named under *.crypto.com, already in scope
travel.crypto.com· url
hostinger
1 scope item described in words
Managed OpenClaw· other
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.