New in bug bounty scope: week 32, 2026

Aug 3 to Aug 9, 2026 · published 2026-11-03

44 assets newly entered public bug-bounty scope in week 32 of 2026 (Aug 3 to Aug 9, 2026) on 7 programs: Exodus, Box BB, Coinbase, GoTo Financial - Public Bounty Program and 3 more. Each asset was checked against its program's own scope history: 2 raw additions that week were assets put back after a removal and 8 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Box BB

HackerOne · 11 new assets

account.box.com · url · max severity critical · since 2026-08-05
api.box.com · url · max severity critical · since 2026-08-05
app.box.com · url · max severity critical · since 2026-08-05
cloud.app.box.com · url · max severity critical · since 2026-08-05
dl.boxcloud.com · url · max severity critical · since 2026-08-05
m.box.com · url · max severity critical · since 2026-08-05
notes.services.box.com · url · max severity critical · since 2026-08-05
upload.box.com · url · max severity critical · since 2026-08-05
3 scope items described in words
- Android Box Mobile App · mobile
- Box Drive · other
- iOS Box Mobile App · mobile

New assets on existing programs

Exodus

HackerOne · 20 new assets · 3 publicly disclosed reports, most often: Uncontrolled Resource Consumption (1)

https://github.com/ExodusOSS/bytes · source · max severity critical · since 2026-08-06
https://github.com/ExodusOSS/crypto · source · max severity critical · since 2026-08-06
https://github.com/ExodusOSS/hydra · source · max severity critical · since 2026-08-06
11 named under *.a.exodus.io, *.exodus.com, *.exodus.io, already in scope
- ctr.a.exodus.io · url
- fiat-p.a.exodus.io · url
- fiat-prod-fallback.a.exodus.io · url
- fiat.a.exodus.io · url
- kyc.a.exodus.io · url
- login.exodus.com · url
- nexotrack-p.exodus.io · url
- nexotrack.exodus.io · url
- pay-admin.exodus.io · url
- pay.exodus.io · url
- turing.exodus.io · url
4 listed on www.npmjs.com
- https://www.npmjs.com/package/@exodus/errors · source
- https://www.npmjs.com/package/@exodus/keychain · source
- https://www.npmjs.com/package/@exodus/safe-string · source
- https://www.npmjs.com/package/@exodus/sentry-client · source
2 scope items described in words
- Smart Contract: Solana - EQYRmLmkE7G7a2WQyojwrXg4SeguypCdnbm3ecncizsd · other
- Smart Contract: Solana mainnet - xoUSDq85Rjsb6SbUwJyreFgeWQvxdkT7R3c3g7s6p5Y · other

Coinbase

HackerOne · 2 new assets · 80 publicly disclosed reports, most often: Improper Authentication - Generic (15), Violation of Secure Design Principles (14), Information Disclosure (9)

*.base.app · wildcard · max severity critical · since 2026-08-08
https://github.com/base/* · source · max severity critical · since 2026-08-08

GoTo Financial - Public Bounty Program

YesWeHack · up to $ 5,000 · 1 new asset

*.mab.co.id · wildcard · since 2026-08-03

GOJEK - Public Bounty Program

YesWeHack · up to $ 3,500 · 4 new assets

1 named under *.gojek.com, already in scope
- gocorp.gojek.com · url
3 listed on apps.apple.com, play.google.com
- https://apps.apple.com/sg/app/gojek-driver/id1573529788 · mobile
- https://play.google.com/store/apps/details?id=com.gojek.partner · mobile
- https://play.google.com/store/apps/details?id=com.gojek.resto · mobile

Majid Al Futtaim Properties

Bugcrowd · up to $2,500 · 5 new assets

5 listed on apps.apple.com, play.google.com
- https://apps.apple.com/in/app/city-centres/id1448471823 · mobile
- https://apps.apple.com/in/app/mall-of-egypt-official-app/id1441905105 · mobile
- https://apps.apple.com/in/app/mall-of-the-emirates-moe/id1449578693 · mobile
- https://play.google.com/store/apps/details?id=com.belongi.citycenter&hl=en_IN · mobile
- https://play.google.com/store/search?q=mall+of+emirates&c=apps&hl=en_IN · mobile

AgilePulse Marketplace Bug Bounty Program

Bugcrowd · up to $1,500 · 1 new asset

1 listed on marketplace.atlassian.com
- https://marketplace.atlassian.com/apps/3402280988/laya-board?hosting=cloud&tab=overview · url

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.