New in bug bounty scope: week 19, 2026

May 4 to May 10, 2026 · published 2026-11-03

173 assets newly entered public bug-bounty scope in week 19 of 2026 (May 4 to May 10, 2026) on 11 programs: NBA Public Bug Bounty, Coupang Taiwan, Remitly, Anthropic and 7 more. Each asset was checked against its program's own scope history: 31 raw additions that week were assets put back after a removal and 11 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Coupang Taiwan

HackerOne · 47 new assets

ads-partners.tw.coupang.com · url · max severity critical · since 2026-05-06
cart-front-api.tw.coupang.com · url · max severity critical · since 2026-05-06
cart.tw.coupang.com · url · max severity critical · since 2026-05-06
cash.tw.coupang.com · url · max severity critical · since 2026-05-06
checkout.tw.coupang.com · url · max severity critical · since 2026-05-06
cmapi.tw.coupang.com · url · max severity critical · since 2026-05-06
dco.tw.coupang.com · url · max severity critical · since 2026-05-06
developers.tw.coupangcorp.com · url · max severity critical · since 2026-05-06
feed-web.tw.coupang.com · url · max severity critical · since 2026-05-06
fileupload-video.tw.coupang.com · url · max severity critical · since 2026-05-06
fileupload.tw.coupang.com · url · max severity critical · since 2026-05-06
fintech-aml-kyc-tw.coupang.com · url · max severity critical · since 2026-05-06
go-cms.tw.coupang.com · url · max severity critical · since 2026-05-06
helpcenter-tw.coupangcorp.com · url · max severity critical · since 2026-05-06
helpseller.tw.coupangcorp.com · url · max severity critical · since 2026-05-06
id.tw.coupang.com · url · max severity critical · since 2026-05-06
influencers.tw.coupang.com · url · max severity critical · since 2026-05-06
link.tw.coupang.com · url · max severity critical · since 2026-05-06
ljc-test.tw.coupang.com · url · max severity critical · since 2026-05-06
ljc.tw.coupang.com · url · max severity critical · since 2026-05-06
logs-partners.tw.coupang.com · url · max severity critical · since 2026-05-06
loyalty.tw.coupang.com · url · max severity critical · since 2026-05-06
m.tw.coupang.com · url · max severity critical · since 2026-05-06
marketplace.tw.coupangcorp.com · url · max severity critical · since 2026-05-06
mauth.tw.coupang.com · url · max severity critical · since 2026-05-06
and 20 more
2 scope items described in words
- SUPERAPP (AOS) · mobile
- SUPERAPP (IOS) · mobile

Anthropic

HackerOne · 14 new assets

Claude Desktop Extensions and Claude.ai MCP servers · other · max severity critical · since 2026-05-07
anthropic.atlassian.com · url · max severity critical · since 2026-05-07
api.anthropic.com · url · max severity critical · since 2026-05-07
claude.ai · url · max severity critical · since 2026-05-07
console.anthropic.com · url · max severity critical · since 2026-05-07
docs.anthropic.com · url · max severity critical · since 2026-05-07
github.com/anthropics · source · max severity critical · since 2026-05-07
support.anthropic.com · url · max severity critical · since 2026-05-07
6 scope items described in words
- API & SDKs · other
- Claude Code · other
- Claude in Chrome · other
- Infrastructure & Internal Apps/Services · other
- Leaked Employee API Keys · other
- Official Clients · other

Refined

Bugcrowd · up to $2,500 · 8 new assets

bugbounty-refined-test-<bugcrowd-name>.refined.site · url · since 2026-05-06
https://refinedsites.refinedwiki.com · url · since 2026-05-06
refined.site/admin · url · since 2026-05-06
5 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1211136/refined-macro-toolkit-content-formatting-macros?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1216056/refined-toolkit-for-confluence-cloud?hosting=cloud&tab=overview · other
- https://marketplace.atlassian.com/apps/1218481/refined-for-jira-cloud?hosting=cloud&tab=overview · other
- https://marketplace.atlassian.com/apps/1221322/refined-for-confluence-cloud?hosting=cloud&tab=overview · other
- https://marketplace.atlassian.com/apps/1236998/refined-ui-toolkit-for-confluence-page-builder-navigation?hosting=cloud&tab=overview · url

celix Solutions GmbH Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 1 new asset

1 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/37658/column-order-gadget-plugin?hosting=cloud&tab=overview · url

Quirk Consulting Marketplace Bug Bounty

Bugcrowd · up to $1,500 · 2 new assets

2 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/1221796/dependency-mapper-for-jira?hosting=cloud&tab=overview · url
- https://marketplace.atlassian.com/apps/1229966/scrum-master-assistant-for-jira?hosting=cloud&tab=overview · url

New assets on existing programs

NBA Public Bug Bounty

HackerOne · 52 new assets

auth-identity-dev-ping.nba.com · url · max severity critical · since 2026-05-06
auth-identity-ping.nba.com · url · max severity critical · since 2026-05-06
auth-identity-qa-ping.nba.com · url · max severity critical · since 2026-05-06
auth-identity-uat-ping.nba.com · url · max severity critical · since 2026-05-06
core-api-aws-dev.nba.com · url · max severity critical · since 2026-05-06
core-api-aws-prod-east1.nba.com · url · max severity critical · since 2026-05-06
core-api-aws-prod.nba.com · url · max severity critical · since 2026-05-06
core-api-aws-qa.nba.com · url · max severity critical · since 2026-05-06
core-api-aws-uat.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-aws-qa.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-aws-uat-uw2.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-aws-uat.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-dev-aws.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-dev-preview.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-preview.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-qa-aws.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-qa-preview.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-uat-preview.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-uat-uc-preview.nba.com · url · max severity critical · since 2026-05-06
cweb-ott-uc-preview.nba.com · url · max severity critical · since 2026-05-06
cweb-qa-aws-preview.nba.com · url · max severity critical · since 2026-05-06
cweb-slot1-ott-dev.nba.com · url · max severity critical · since 2026-05-06
cweb-slot2-ott-dev.nba.com · url · max severity critical · since 2026-05-06
cweb-slot3-ott-dev.nba.com · url · max severity critical · since 2026-05-06
cweb-slot4-ott-dev.nba.com · url · max severity critical · since 2026-05-06
and 27 more

Remitly

HackerOne · 45 new assets · 1 publicly disclosed report, most often: Improper Access Control - Generic (1)

beamitmobile.com · url · max severity medium · since 2026-05-07
getorigen.com · url · max severity medium · since 2026-05-07
getsurenow.com · url · max severity medium · since 2026-05-07
insuritly.com · url · max severity medium · since 2026-05-07
origenapp.com · url · max severity medium · since 2026-05-07
origenbanking.com · url · max severity medium · since 2026-05-07
origencard.com · url · max severity medium · since 2026-05-07
origendebit.com · url · max severity medium · since 2026-05-07
origenfinance.com · url · max severity medium · since 2026-05-07
remilty.net · url · max severity medium · since 2026-05-07
remilty.org · url · max severity medium · since 2026-05-07
remitir.com · url · max severity medium · since 2026-05-07
remitiy.com · url · max severity medium · since 2026-05-07
remitly-3pjs.com · url · max severity medium · since 2026-05-07
remitly-vendor.com · url · max severity medium · since 2026-05-07
remitly.ca · url · max severity medium · since 2026-05-07
remitly.cash · url · max severity medium · since 2026-05-07
remitly.co · url · max severity medium · since 2026-05-07
remitly.co.uk · url · max severity medium · since 2026-05-07
remitly.com.au · url · max severity medium · since 2026-05-07
remitly.com.mx · url · max severity medium · since 2026-05-07
remitly.de · url · max severity medium · since 2026-05-07
remitly.es · url · max severity medium · since 2026-05-07
remitly.eu · url · max severity medium · since 2026-05-07
remitly.fr · url · max severity medium · since 2026-05-07
and 20 more

pixiv

HackerOne · 1 new asset · 14 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Reflected (2), Open Redirect (2), Cross-Site Request Forgery (CSRF) (1)

premium.pixiv.net · url · max severity critical · since 2026-05-07

Stripe

HackerOne · 1 new asset · 27 publicly disclosed reports, most often: Improper Access Control - Generic (5), Insecure Direct Object Reference (IDOR) (3), Cross-Site Request Forgery (CSRF) (3)

mcp.stripe.com · url · max severity critical · since 2026-05-08

MercadoLibre

HackerOne · 1 new asset · 6 publicly disclosed reports, most often: Cross-site Scripting (XSS) - Stored (2), Code Injection (1), Insecure Direct Object Reference (IDOR) (1)

1 scope item described in words
- Tier 3 · other

Spotify

HackerOne · 1 new asset

1 scope item described in words
- Save to Spotify CLI · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.