New in bug bounty scope: week 36, 2026
72 assets newly entered public bug-bounty scope in week 36 of 2026 (Aug 31 to Sep 6, 2026) on 15 programs: NBA Public Bug Bounty, Amazon Vulnerability Research Program, SBB - Swiss Federal Railways, Agoda Public and 11 more. Each asset was checked against its program's own scope history: 55 raw additions that week were assets put back after a removal and 27 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.
New programs
Akeles Marketplace Bug Bounty
15 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1211116/countdown-timer?tab=overview&hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1211314/three-dimensional-date-gadgets?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1211976/gauge-gadget?hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1214394/menu-gadget?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1214613/multiple-filters-chart-gadget?hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1215764/calendar-heatmap-gadget?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1217056/canned-search-for-confluence?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1217224/countdown-gadget?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1223780/tissue-table-of-linked-issues?hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1224848/banners-for-confluence?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1225375/site-statistics-for-jira-cloud?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1229447/site-statistics-for-confluence-cloud?tab=overview&hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1237524/dashboard-assistant-for-jira-cloud?hosting=cloud· urlhttps://marketplace.atlassian.com/apps/1238069/file-type-checker-for-jira-cloud?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1238098/project-access-review-for-jira-cloud?hosting=cloud&tab=overview· url
APTIS
1 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1213091/esu-sum-up-kpi-budget-reporting-project-epic-overview?hosting=cloud&tab=overview· url
Okapya
1 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1233908/connectors-for-jira-free?hosting=cloud· url
Shinetech Software Inc Marketplace Managed Bug Bounty Engagement
2 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1221271/easy-heading-macro-floating-table-of-contents?hosting=cloud&tab=overview· urlhttps://marketplace.atlassian.com/apps/1221271/easy-heading-macro-floating-table-of-contents?hosting=datacenter· url
Xopero Software S.A. Marketplace Managed Bug Bounty Engagement
1 listed on marketplace.atlassian.com
https://marketplace.atlassian.com/apps/1228719/gitprotect-io-for-jira-backup-restore-dr-data-management?hosting=cloud· url
New assets on existing programs
NBA Public Bug Bounty
gldatacenter.nba.com· url · max severity critical · since 2026-09-01nbavideo.nba.com· url · max severity critical · since 2026-09-01peopleanalyticsportal.nba.com· url · max severity critical · since 2026-09-01playerhealthvideo.nba.com· url · max severity critical · since 2026-09-01stockton-dev.gleague.nba.com· url · max severity critical · since 2026-09-01stockton-qa.gleague.nba.com· url · max severity critical · since 2026-09-01stockton.gleague.nba.com· url · max severity critical · since 2026-09-01texas-qa.gleague.nba.com· url · max severity critical · since 2026-09-01texas.gleague.nba.com· url · max severity critical · since 2026-09-01townhall.nba.com· url · max severity critical · since 2026-09-01westchester-dev.gleague.nba.com· url · max severity critical · since 2026-09-01westchester-qa.gleague.nba.com· url · max severity critical · since 2026-09-01westchester.gleague.nba.com· url · max severity critical · since 2026-09-01windycity-dev.gleague.nba.com· url · max severity critical · since 2026-09-01windycity-qa.gleague.nba.com· url · max severity critical · since 2026-09-01windycity.gleague.nba.com· url · max severity critical · since 2026-09-01wisconsin-dev.gleague.nba.com· url · max severity critical · since 2026-09-01wisconsin-qa.gleague.nba.com· url · max severity critical · since 2026-09-01wisconsin.gleague.nba.com· url · max severity critical · since 2026-09-01wnbabroadcastmanuals.nba.com· url · max severity critical · since 2026-09-01
Amazon Vulnerability Research Program
1324809509· mobile · max severity critical · since 2026-09-041528364633· mobile · max severity critical · since 2026-09-04302584613· mobile · max severity critical · since 2026-09-04621574163· mobile · max severity critical · since 2026-09-04944011620· mobile · max severity critical · since 2026-09-04947984433· mobile · max severity critical · since 2026-09-04Devices· other · max severity none · since 2026-09-04FireTV· device · max severity critical · since 2026-09-04Luna· device · max severity critical · since 2026-09-04Services/Mobile/GenAI· other · max severity none · since 2026-09-04Tablets· device · max severity critical · since 2026-09-04com.amazon.clouddrive.photos· mobile · max severity critical · since 2026-09-04com.amazon.dee.alexaonwearos· mobile · max severity critical · since 2026-09-04com.amazon.dee.app· mobile · max severity critical · since 2026-09-04com.amazon.kindle· mobile · max severity critical · since 2026-09-04com.amazon.storm.lightning.client.aosp· mobile · max severity critical · since 2026-09-04com.amazon.tahoe.freetime· mobile · max severity critical · since 2026-09-04com.amazon.tails· mobile · max severity critical · since 2026-09-043 scope items described in words
Echo Family Devices· deviceKindle E-Reader· deviceVega OS· other
SBB - Swiss Federal Railways
*elvetino.ch· wildcard · max severity Tier 3 · since 2026-09-02*sbbcargo.com· wildcard · max severity Tier 3 · since 2026-09-02*transsicura.ch· wildcard · max severity Tier 3 · since 2026-09-02
Agoda Public
https://www.agoda.com/account/agodacash· url · max severity critical · since 2026-09-01https://www.agoda.com/account/cashback· url · max severity critical · since 2026-09-01
OKG
https://github.com/okx/go-wallet-sdk· source · max severity critical · since 2026-08-31
Visa
sandbox.developer.plus.authorize.net· url · max severity critical · since 2026-08-31
Wealthsimple
com.wealthsimple.predict· mobile · max severity critical · since 2026-09-02
OpenSea Managed Bug Bounty Program
1 scope item described in words
OpenSea Solana Marketplace Program· other
T-Mobile
1 scope item described in words
Subdomain Takeover· other
Box BB
1 scope item described in words
Box Tools· other
← previous week · all weeks · next week →
An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.