New in bug bounty scope: week 26, 2026
28 assets newly entered public bug-bounty scope in week 26 of 2026 (Jun 22 to Jun 28, 2026) on 7 programs: Requirement Yogi (Bug bounty), VRT, Hilton, SIX Group and 3 more. Each asset was checked against its program's own scope history: 13 raw additions that week were assets put back after a removal and 7 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
Requirement Yogi (Bug bounty)
https://api.requirementyogi.com· api · since 2026-06-25https://app.requirementyogi.com· url · since 2026-06-25https://auth.requirementyogi.com· url · since 2026-06-25https://confluence.requirementyogi.com· url · since 2026-06-25https://jira.requirementyogi.com· url · since 2026-06-25https://ww1.requirementyogi.cloud· url · since 2026-06-25https://ww2.requirementyogi.cloud· url · since 2026-06-252 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1212523/requirements-yogi?hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1214094/requirement-yogi-for-jira?hosting=cloud· url
AgilePulse Marketplace Bug Bounty Program
7 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1143291390/sprintpoker-planning-poker-async-estimation?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1233038/agility-poker-planning?tab=overview&hosting=cloud· urlhttps://marketplace.atlassian.com/apps/187209184/sprintretro-free-retrospective-metrics-suite?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/2903137599/sprintretro-pro-retrospective-metrics-suite?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/3684126567/laya-workflowos-ai-automation-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/3780102417/sprintpoker-free-planning-poker-async-estimation?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/4076194710/laya-export-studio-for-jira-and-confluence?hosting=cloud&tab=overview· url
Redmoon
5 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1211639/comment-history-for-jira?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1211880/document-vault-secure-attachments-in-jira?tab=installation&hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1213649/custom-fields-for-jira-cloud?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1213851/watch-it-for-jira-cloud?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1214056/sub-task-manager-for-jira?hosting=cloud&tab=overview· url
New assets on existing programs
VRT
Sockets· other · max severity Tier 2 · since 2026-06-22vrt.be/interactie/121-chat/· url · max severity Tier 2 · since 2026-06-22
Hilton
com.hilton.android.hhonors· mobile · max severity critical · since 2026-06-24id635150066· mobile · max severity critical · since 2026-06-241 scope item described in words
Hilton Franchised Properties· other
SIX Group
https://disclosure-test.six-exchange-regulation.com/· url · max severity critical · since 2026-06-23
Deviniti
1 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/22817756/procuro-complete-procurement-management-in-jsm?hosting=cloud&tab=overview· url
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.