vuln·telMCP serverToolsNew in scopeGuidesField notesGet a key

New in bug bounty scope: week 29, 2026

Jul 13 to Jul 19, 2026 · published 2026-11-03

62 assets newly entered public bug-bounty scope in week 29 of 2026 (Jul 13 to Jul 19, 2026) on 6 programs: Klaviyo Managed Bug Bounty, Agilis LT Bug Bounty, ClickHouse, Superhuman (formerly Grammarly) and 2 more. Each asset was checked against its program's own scope history: 14 raw additions that week were assets put back after a removal and 0 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Klaviyo Managed Bug Bounty

Bugcrowd · up to $3,500 · 51 new assets

  • http://mcp.klaviyo.com/ · other · since 2026-07-16
  • https://*.clovesoftware-dev.com · url · since 2026-07-16
  • https://*.clovesoftware.com · url · since 2026-07-16
  • https://*.klaviyo-dev.com/* · url · since 2026-07-16
  • https://*.klaviyomsv.com/* · url · since 2026-07-16
  • https://*.myklpages.com/* · url · since 2026-07-16
  • https://*.services.klaviyo.com · url · since 2026-07-16
  • https://a.klaviyo.com/api/* · api · since 2026-07-16
  • https://klaviyo.com/* · url · since 2026-07-16
  • 42 scope items described in words
    • Klaviyo AWS/S3 Assets · other
    • Klaviyo Infrascucture - 50.150.76.0/30 · other
    • Klaviyo Infrastructure - 12.109.179.242/32 · other
    • Klaviyo Infrastructure - 12.109.179.243/32 · other
    • Klaviyo Infrastructure - 12.109.179.244/32 · other
    • Klaviyo Infrastructure - 12.162.226.194/32 · other
    • Klaviyo Infrastructure - 12.162.226.195/32 · other
    • Klaviyo Infrastructure - 12.162.226.196/32 · other
    • Klaviyo Infrastructure - 12.162.226.197/32 · other
    • Klaviyo Infrastructure - 12.162.226.198/32 · other
    • Klaviyo Infrastructure - 13.236.111.63/32 · other
    • Klaviyo Infrastructure - 14.200.250.155/32 · other
    • Klaviyo Infrastructure - 14.200.250.156/32 · other
    • Klaviyo Infrastructure - 144.121.5.144/29 · other
    • Klaviyo Infrastructure - 144.121.57.208/29 · other
    • Klaviyo Infrastructure - 18.133.56.249/32 · other
    • Klaviyo Infrastructure - 18.144.159.16/32 · other
    • Klaviyo Infrastructure - 18.168.137.251/32 · other
    • Klaviyo Infrastructure - 18.168.212.94/32 · other
    • Klaviyo Infrastructure - 18.168.232.92/32 · other
    • Klaviyo Infrastructure - 23.20.21.255/32 · other
    • Klaviyo Infrastructure - 3.105.93.78/32 · other
    • Klaviyo Infrastructure - 3.208.141.108/32 · other
    • Klaviyo Infrastructure - 3.222.226.200/32 · other
    • Klaviyo Infrastructure - 38.140.97.154/32 · other
    • Klaviyo Infrastructure - 38.140.97.155/32 · other
    • Klaviyo Infrastructure - 38.140.97.156/32 · other
    • Klaviyo Infrastructure - 44.197.10.144/32 · other
    • Klaviyo Infrastructure - 46.31.171.122/32 · other
    • Klaviyo Infrastructure - 46.31.171.123/32 · other
    • Klaviyo Infrastructure - 50.18.34.165/32 · other
    • Klaviyo Infrastructure - 50.228.235.80/29 · other
    • Klaviyo Infrastructure - 52.8.118.227/32 · other
    • Klaviyo Infrastructure - 54.160.106.200/32 · other
    • Klaviyo Infrastructure - 64.125.104.194/32 · other
    • Klaviyo Infrastructure - 64.125.104.195/32 · other
    • Klaviyo Infrastructure - 64.125.104.196/32 · other
    • Klaviyo Infrastructure - 64.125.104.197/32 · other
    • Klaviyo Infrastructure - 64.125.104.198/32 · other
    • Klaviyo Infrastructure - 64.71.19.71/32 · other
    • Klaviyo Infrastructure - 82.144.244.58/32 · other
    • Klaviyo Infrastructure - 82.144.244.59/32 · other

BOJA Consulting Bug Bounty

Bugcrowd · up to $1,500 · 4 new assets

  • 4 listed on marketplace.atlassian.com
    • https://marketplace.atlassian.com/apps/1218036/agile-project-forecast-metrics-roadmap-portfolio?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1218555/easy-pdf-html-word-export-to-custom-documents?hosting=cloud · url
    • https://marketplace.atlassian.com/apps/1223298/agile-risk-management-for-jira-cloud?hosting=cloud&tab=overview · url
    • https://marketplace.atlassian.com/apps/1226195/align-okr-with-roadmap?hosting=cloud&tab=overview · url

New assets on existing programs

Agilis LT Bug Bounty

Bugcrowd · up to $1,500 · 2 new assets

  • *app.simple-reports.com/demo · url · since 2026-07-14
  • app.simple-reports.com/demo · url · since 2026-07-14

ClickHouse

Bugcrowd · up to $2,500 · 1 new asset

  • https://cloud.langfuse.com/ · url · since 2026-07-14

Elastic

HackerOne · 1 new asset · 20 publicly disclosed reports, most often: Privilege Escalation (3), Cross-site Scripting (XSS) - Stored (3), Improper Access Control - Generic (3)

  • 1 scope item described in words
    • Subdomain takeover · other

Superhuman (formerly Grammarly)

HackerOne · 3 new assets

  • 1 named under *.superhuman.com, already in scope
    • mail.superhuman.com · url
  • 2 scope items described in words
    • Superhuman Mail Chrome Extension · other
    • Superhuman Mail Desktop App · other

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.