New in bug bounty scope: week 27, 2026
19 assets newly entered public bug-bounty scope in week 27 of 2026 (Jun 29 to Jul 5, 2026) on 5 programs: REA Group | realestate.com.au, realcommercial.com.au, property.com.au, Blofin Crypto Managed Bug Bounty Engagement, Monash University Bug Bounty, Unity Technologies and 1 more. Each asset was checked against its program's own scope history: 58 raw additions that week were assets put back after a removal and 3 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
Blofin Crypto Managed Bug Bounty Engagement
*.blofin.com· url · since 2026-07-02https://blofin.com· url · since 2026-07-02https://wallet.blofin.com/en· url · since 2026-07-024 listed on apps.apple.com, play.google.com
https://apps.apple.com/tt/app/blofin/id1616804346· mobilehttps://apps.apple.com/us/app/blofin-wallet/id6753210919· mobilehttps://play.google.com/store/apps/details?id=com.blofin.android· mobilehttps://play.google.com/store/apps/details?id=com.blofin.wallet.wallet· mobile
New assets on existing programs
REA Group | realestate.com.au, realcommercial.com.au, property.com.au
https://*.report.uat.proptrack.com· url · since 2026-06-29https://access-sit.uat.proptrack.com· url · since 2026-06-29https://desktop-sit.uat.proptrack.com· url · since 2026-06-29https://explore-sit.uat.proptrack.com· url · since 2026-06-29https://one-sit.uat.proptrack.com/· url · since 2026-06-29https://portfolio-manager-sit.uat.proptrack.com/· url · since 2026-06-29https://valuations-sit.uat.proptrack.com· url · since 2026-06-29https://www.proptrack.com· url · since 2026-06-29https://www.proptrack.com.au· url · since 2026-06-29
Monash University Bug Bounty
https://equella.monash.edu· url · since 2026-06-30
Unity Technologies
https://unity.com/download· other · since 2026-06-29
ZECIBLE PUBLIC BUG BOUNTY PROGRAM
ywh.zcb.fr· url · since 2026-06-30
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.