New in bug bounty scope: week 31, 2026

Jul 27 to Aug 2, 2026 · published 2026-11-03

132 assets newly entered public bug-bounty scope in week 31 of 2026 (Jul 27 to Aug 2, 2026) on 9 programs: Posti Bug Bounty, NBA Public Bug Bounty, Majid Al Futtaim Customer Solutions, Majid Al Futtaim Properties and 5 more. Each asset was checked against its program's own scope history: 24 raw additions that week were assets put back after a removal and 50 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Posti Bug Bounty

Intigriti · up to EUR 2,000 · 43 new assets

410789057 · mobile · max severity Tier 2 · since 2026-07-31
api.posti.fi · url · max severity Tier 2 · since 2026-07-31
auth-service.posti.fi · url · max severity Tier 2 · since 2026-07-31
cdn.posti.fi · url · max severity Tier 2 · since 2026-07-31
connect.posti.fi · url · max severity Tier 2 · since 2026-07-31
console.posti.com · url · max severity Tier 2 · since 2026-07-31
developer.posti.com · url · max severity Tier 2 · since 2026-07-31
elma.elma.fi · url · max severity Tier 2 · since 2026-07-31
fi.itella.posti.android · mobile · max severity Tier 2 · since 2026-07-31
gateway.posti.fi · url · max severity Tier 2 · since 2026-07-31
https://kontakti.posti.fi · url · max severity Tier 2 · since 2026-07-31
https://my.account.posti.fi · url · max severity Tier 2 · since 2026-07-31
https://my.smartposti.ee/ · url · max severity Tier 2 · since 2026-07-31
https://my.smartposti.lt · url · max severity Tier 2 · since 2026-07-31
https://my.smartposti.lv · url · max severity Tier 2 · since 2026-07-31
https://oma.posti.fi/ · url · max severity Tier 2 · since 2026-07-31
https://printerdriver.posti.com/ · url · max severity Tier 2 · since 2026-07-31
https://pro.posti.fi · url · max severity Tier 2 · since 2026-07-31
https://quicksight.aws.amazon.com · url · max severity Tier 2 · since 2026-07-31
https://shop.posti.fi · url · max severity Tier 2 · since 2026-07-31
https://tuleasiakkaaksi.posti.fi · url · max severity Tier 2 · since 2026-07-31
https://www.posti.fi · url · max severity Tier 2 · since 2026-07-31
https://www.smartposti.ee · url · max severity Tier 2 · since 2026-07-31
https://www.smartposti.lt · url · max severity Tier 2 · since 2026-07-31
https://www.smartposti.lv · url · max severity Tier 2 · since 2026-07-31
and 18 more

Wolt

HackerOne · 12 new assets

*.wolt.com · wildcard · max severity critical · since 2026-07-28
1477299281 · mobile · max severity critical · since 2026-07-28
943905271 · mobile · max severity critical · since 2026-07-28
authentication.wolt.com · url · max severity critical · since 2026-07-28
com.wolt.android · mobile · max severity critical · since 2026-07-28
com.wolt.courierapp · mobile · max severity critical · since 2026-07-28
corporate.wolt.com · url · max severity critical · since 2026-07-28
drive.wolt.com · url · max severity critical · since 2026-07-28
merchant.wolt.com · url · max severity critical · since 2026-07-28
ops.wolt.com · url · max severity critical · since 2026-07-28
restaurant-api.wolt.com · url · max severity critical · since 2026-07-28
wolt.com · url · max severity critical · since 2026-07-28

New assets on existing programs

NBA Public Bug Bounty

HackerOne · 33 new assets

ak-static-dev.nba.com · url · max severity critical · since 2026-07-30
bealegend.nba.com · url · max severity critical · since 2026-07-30
cdn-gleague-dev.nba.com · url · max severity critical · since 2026-07-30
cdn-gleague-qa.nba.com · url · max severity critical · since 2026-07-30
ec2-redirect-west.nba.com · url · max severity critical · since 2026-07-30
ec2redirect-west.nba.com · url · max severity critical · since 2026-07-30
gatoradetrainingcenter.nba.com · url · max severity critical · since 2026-07-30
globalstores-dev.nba.com · url · max severity critical · since 2026-07-30
globalstores-qa.nba.com · url · max severity critical · since 2026-07-30
globalstores.nba.com · url · max severity critical · since 2026-07-30
hoopsfortroops.nba.com · url · max severity critical · since 2026-07-30
indiaontrack.nba.com · url · max severity critical · since 2026-07-30
jrnbaworldchampionship-QA.nba.com · url · max severity critical · since 2026-07-30
jrnbaworldchampionship-dev.nba.com · url · max severity critical · since 2026-07-30
jrnbaworldchampionship.nba.com · url · max severity critical · since 2026-07-30
lockervisionteam.nba.com · url · max severity critical · since 2026-07-30
nba-ar-app.nba.com · url · max severity critical · since 2026-07-30
nbabroadcastmanuals.nba.com · url · max severity critical · since 2026-07-30
nbaholidaycard-dev.nba.com · url · max severity critical · since 2026-07-30
nbaholidaycard-qa.nba.com · url · max severity critical · since 2026-07-30
nbaholidaycard.nba.com · url · max severity critical · since 2026-07-30
pdfroster-dev.nba.com · url · max severity critical · since 2026-07-30
pdfroster-qa.nba.com · url · max severity critical · since 2026-07-30
stats-qa.gleague.nba.com · url · max severity critical · since 2026-07-30
stats-querytoolapi.nba.com · url · max severity critical · since 2026-07-30
and 8 more

Majid Al Futtaim Customer Solutions

Bugcrowd · up to $2,500 · 20 new assets

https://identity.majidalfuttaim.com · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/0dfwUn870OFm3aebVTKv0xz1viKKyXlL · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/8VdAQsuIqDPQhsNC1sNQtS2Jf7anninl · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/9AHmz8YYRY6OVVTNHtLKjrFgwovO1eDE · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/9h0hkx6nBNSDuhTSFySzPgcFyXrHOVNI · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/C1o8u0aPez0Qs5W5TGa1Cbpxq8Ieb63G · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/I3ev7JpJpG4tmIKuXfQ5s29e1uUgtdaL · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/VhYxO10cBfgbvQ1KzcO0XYIsz9kLahZ6 · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/abGQxSUDBML2iWEP9P1KWjxnUi7RwfT1 · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/bN1YiObxLzbCkU6z6lRdE8jpGgEM2bqG · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/gbYSXvAJqSRL0gb76oaWWBojroIDBJrb · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/gsUkX5A6BA7wJLQxEiIjdC8PDrNJ42Mo · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/hqrMBSRmjuH85ACKnBvUEvOoBJllGPWn · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/kfwPMuCVbxNPvPpfDKiyvgVvHWmThXc8 · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/mPbXCx7lA4dQNyEhhyCGMV6XKjuccbk8 · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/p1Ji7cKQ7RG5KU3Jjuke5ZMG6vfWe0IV · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/v0uVcrcyayqiTSbRUJPAWz2YJNN1tHTy · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/xD3ktDwA9dnX1xNLig2S3oM8xvxXTnty · url · since 2026-07-30
https://lazzx4o5mh.execute-api.eu-west-1.amazonaws.com/production/landing/client/zISrnnxfS19jUJTUAtnFaTUkAJ27r8mE · url · since 2026-07-30
https://www.premogiftcards.com/ · url · since 2026-07-30

Majid Al Futtaim Properties

Bugcrowd · up to $2,500 · 15 new assets

https://api.mafshoppingmalls.com · api · since 2026-07-31
https://atjunction.com/ · url · since 2026-07-31
https://citycentredeira.com/ · url · since 2026-07-31
https://ecoupon.maf.ae/ · url · since 2026-07-31
https://maf-properties-prod.apigee.net · api · since 2026-07-31
https://partnerconnect.maf.ae/ · url · since 2026-07-31
https://smbu-api.maf.ae/ · api · since 2026-07-31
https://smbu.mafcms.com/Sitefinity/adminapp/renderer/dashboard · url · since 2026-07-31
https://www.citycentremalls.com/en · url · since 2026-07-31
https://www.ghafwoods.com/en · url · since 2026-07-31
https://www.majidalfuttaimproperties.com/en · url · since 2026-07-31
https://www.mycitycentrealbarsha.com/ · url · since 2026-07-31
https://www.tilalalghaf.com/en · url · since 2026-07-31
2 listed on apps.apple.com, play.google.com
- https://apps.apple.com/us/app/belong-by-maf/id6443736108 · mobile
- https://play.google.com/store/apps/details?id=com.maf.communities&hl=en-US · mobile

MoonPay

HackerOne · 4 new assets

api.moonx-dev.com · url · max severity critical · since 2026-07-30
api.paybox.sh · url · max severity critical · since 2026-07-30
app.paybox.sh · url · max severity critical · since 2026-07-30
iframe.moonx-dev.com · url · max severity critical · since 2026-07-30

Axel Springer National Media & Tech

Intigriti · up to EUR 2,500 · 1 new asset

newsos.com · url · max severity Tier 2 · since 2026-07-28

OpenSea Managed Bug Bounty Program

Bugcrowd · up to $3,000,000 · 1 new asset

1 scope item described in words
- Agent SDKs · other

Varonis

HackerOne · 3 new assets

3 named under *.varonis.com, already in scope
- downloads.varonis.com · url
- licensemgmt.varonis.com · url
- support.varonis.com · url

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.