New in bug bounty scope: week 25, 2026
60 assets newly entered public bug-bounty scope in week 25 of 2026 (Jun 15 to Jun 21, 2026) on 10 programs: Nexo, Recorded Future Public Managed Bug Bounty Engagement, Lightspeed Hospitality, Optus Managed Bug Bounty and 6 more. Each asset was checked against its program's own scope history: 18 raw additions that week were assets put back after a removal and 9 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
Nexo
https://nexo.com/· url · max severity Tier 2 · since 2026-06-18https://platform.nexo.com/· url · max severity Tier 2 · since 2026-06-18https://platform.nexo.com/api/1/create_recurring_payment· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/1/exchange_order· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/1/exchange_request_quote· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/1/get_pay_to_card_fee· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/1/request_bwc_quote· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/1/request_capture_payment· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/1/request_crypto_withdrawal· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/1/request_pay_to_card· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/1/term/deposits/user/create· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/platform/exchange/v1/booster/quotes· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/platform/exchange/v2/booster/orders· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/platform/exchange/v2/exchange/orders· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/trading/advanced/facade/api/v1/deposit· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/trading/advanced/facade/api/v1/fees· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/trading/advanced/facade/api/v1/order/futures· url · max severity Tier 1 · since 2026-06-18https://platform.nexo.com/api/trading/advanced/facade/api/v1/withdraw· url · max severity Tier 1 · since 2026-06-18
Agoda Public
https://www.agoda.com/book/· url · max severity critical · since 2026-06-18
Easy Agile
5 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1212078/easy-agile-user-story-maps-for-jira?hosting=cloud&tab=overview· otherhttps://marketplace.atlassian.com/apps/1215695/easy-agile-roadmaps-for-jira?hosting=cloud&tab=overview· otherhttps://marketplace.atlassian.com/apps/1219491/easy-agile-programs-for-jira?hosting=cloud&tab=overview· otherhttps://marketplace.atlassian.com/apps/1221392/easy-agile-personas-for-jira?hosting=cloud&tab=overview· otherhttps://marketplace.atlassian.com/apps/3443905353?hosting=cloud&tab=overviewPartner· other
Jaanga Marketplace Bug Bounty
4 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1218225?tab=overview&hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1219169/bulk-linker?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1236750?tab=overview&hosting=cloud· urlhttps://marketplace.atlassian.com/apps/2974674253/assets-analytics-custom-dashboards-reporting-for-jira· url
Appsvio Marketplace Bug Bounty
4 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1218221/feature-bundle-for-jira-service-management?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1224654/multilevel-select-for-jira?hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1229162/issue-templates-agent-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1238103/appsvio-test-management-for-jira?hosting=cloud&tab=overview· url
Deviniti
15 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1210820/dynamic-forms-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1211044/issue-templates-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1212161/extension-for-jira-service-desk?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1213346/issue-sync-integration-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1213697/actions-for-jira-service-management?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1216386/queues-for-jira-service-management?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1219647/my-requests-extension-for-jira-service-management?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1220294/requirements-test-management-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1220300/theme-extension-for-jira-service-management?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1220477/entra-id-azure-ad-attributes-sync-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1224763/coji-confluence-pages-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1229958/issue-sync-lite?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1233642/workflow-building-blocks-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1237787?tab=overview&hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1238286/ai-ticket-assistant?hosting=cloud&tab=overview· url
New assets on existing programs
Recorded Future Public Managed Bug Bounty Engagement
https://api.riskrecon.com· api · since 2026-06-17https://api.riskrecon.eu· api · since 2026-06-17https://auth.riskrecon.com· api · since 2026-06-17https://auth.riskrecon.eu· api · since 2026-06-17https://mcp.recordedfuture.com· api · since 2026-06-17https://portal.riskrecon.com· url · since 2026-06-17https://portal.riskrecon.eu· url · since 2026-06-17https://vendor.riskrecon.com· url · since 2026-06-17https://vendor.riskrecon.eu· url · since 2026-06-17https://www.riskrecon.com· url · since 2026-06-17
Lightspeed Hospitality
https://mylightspeed.app· url · since 2026-06-15
Optus Managed Bug Bounty
https://www.optus.com.au/prepaid/activate· url · since 2026-06-19
VFS Global Bug Bounty Program
https://www.vfsglobalcustomerexperience.com/CustomerFeedback/GeneralFeedback/Index· url · since 2026-06-19
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.