New in bug bounty scope: week 30, 2026
125 assets newly entered public bug-bounty scope in week 30 of 2026 (Jul 20 to Jul 26, 2026) on 8 programs: NBA Public Bug Bounty, Glassdoor Managed Bug Bounty Engagement, Abercrombie & Fitch Bug Bounty, Deriv.com and 4 more. Each asset was checked against its program's own scope history: 40 raw additions that week were assets put back after a removal and 8 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
Glassdoor Managed Bug Bounty Engagement
https://api.fishbowlapp.com/*· api · since 2026-07-23https://api.glassdoor.com/*· api · since 2026-07-23https://www.fishbowlapp.com/· other · since 2026-07-23https://www.glassdoor.com/*· api · since 2026-07-23https://www.glassdoor.com/Compare/*· url · since 2026-07-23https://www.glassdoor.com/Job/*· url · since 2026-07-23https://www.glassdoor.com/Reviews/*· url · since 2026-07-23https://www.glassdoor.com/Salaries/*· url · since 2026-07-23https://www.glassdoor.com/employers/ec/*· api · since 2026-07-23https://www.glassdoor.com/member/*· api · since 2026-07-23https://www.glassdoor.com/mz-survey/*· url · since 2026-07-234 listed on apps.apple.com, play.google.com
https://apps.apple.com/us/app/fishbowl-professional-network/id1005070636· mobilehttps://apps.apple.com/us/app/glassdoor-jobs-careers/id589698942· mobilehttps://play.google.com/store/apps/details?id=com.fishbowlmedia.fishbowl&hl=en_US· mobilehttps://play.google.com/store/apps/details?id=com.glassdoor.app&hl=en_US· mobile
Abercrombie & Fitch Bug Bounty
339041767· mobile · max severity critical · since 2026-07-22383915209· mobile · max severity critical · since 2026-07-22abercrombie.com· url · max severity critical · since 2026-07-22anfcorp.com· url · max severity critical · since 2026-07-22com.abercrombie.abercrombie· mobile · max severity critical · since 2026-07-22com.abercrombie.hollister· mobile · max severity critical · since 2026-07-22corporate.abercrombie.com· url · max severity critical · since 2026-07-22hollisterco.com· url · max severity critical · since 2026-07-22
New assets on existing programs
NBA Public Bug Bounty
aguacaliente-dev.gleague.nba.com· url · max severity critical · since 2026-07-23aguacaliente-qa.gleague.nba.com· url · max severity critical · since 2026-07-23aguacaliente.gleague.nba.com· url · max severity critical · since 2026-07-23austin-dev.gleague.nba.com· url · max severity critical · since 2026-07-23austin-qa.gleague.nba.com· url · max severity critical · since 2026-07-23austin.gleague.nba.com· url · max severity critical · since 2026-07-23bakersfield-qa.gleague.nba.com· url · max severity critical · since 2026-07-23bakersfield.gleague.nba.com· url · max severity critical · since 2026-07-23birmingham-dev.gleague.nba.com· url · max severity critical · since 2026-07-23birmingham-qa.gleague.nba.com· url · max severity critical · since 2026-07-23birmingham.gleague.nba.com· url · max severity critical · since 2026-07-23bluecoats-qa.gleague.nba.com· url · max severity critical · since 2026-07-23bluecoats.gleague.nba.com· url · max severity critical · since 2026-07-23canton-dev.gleague.nba.com· url · max severity critical · since 2026-07-23canton-qa.gleague.nba.com· url · max severity critical · since 2026-07-23canton.gleague.nba.com· url · max severity critical · since 2026-07-23capitalcity-dev.gleague.nba.com· url · max severity critical · since 2026-07-23capitalcity-qa.gleague.nba.com· url · max severity critical · since 2026-07-23capitalcity.gleague.nba.com· url · max severity critical · since 2026-07-23capitanes-dev.gleague.nba.com· url · max severity critical · since 2026-07-23capitanes-qa.gleague.nba.com· url · max severity critical · since 2026-07-23capitanes.gleague.nba.com· url · max severity critical · since 2026-07-23cdn-qa.gleague.nba.com· url · max severity critical · since 2026-07-23cdn-uat.gleague.nba.com· url · max severity critical · since 2026-07-23cleveland.gleague.nba.com· url · max severity critical · since 2026-07-23- and 69 more
KOHO
clicks.koho.ca· url · max severity low · since 2026-07-23login.koho.ca· url · max severity critical · since 2026-07-23
SIX Group
https://fx-qa.np.bolsasymercados.es/· url · max severity critical · since 2026-07-22
intigriti
1 named under *.pwn.intigriti.rocks, already in scope
https://metabase.pwn.intigriti.rocks/· url
Deriv.com
3 named under *.deriv.com, already in scope
core-api.deriv.com· urlhome.deriv.com· urlhttps://api-core.deriv.com· url
Hilton
1 named under *.hilton.com, already in scope
resmax.hilton.com· url
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.