New in bug bounty scope: week 38, 2026

Sep 14 to Sep 20, 2026 · published 2026-11-03

27 assets newly entered public bug-bounty scope in week 38 of 2026 (Sep 14 to Sep 20, 2026) on 11 programs: Arc, d-you App & German EUDI Wallet Ecosystem, Faraday, Inc., Infomaniak Bug Bounty program and 7 more. Each asset was checked against its program's own scope history: 14 raw additions that week were assets put back after a removal and 19 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Arc

HackerOne · 6 new assets

*.arc.io · wildcard · max severity critical · since 2026-09-16
https://github.com/circlefin/arc-node · source · max severity critical · since 2026-09-16
https://github.com/circlefin/arc-remote-signer · source · max severity critical · since 2026-09-16
https://github.com/circlefin/malachite · source · max severity critical · since 2026-09-16
rpc.drpc.testnet.arc.network · url · max severity critical · since 2026-09-16
rpc.testnet.arc.network · url · max severity critical · since 2026-09-16

d-you App & German EUDI Wallet Ecosystem

HackerOne · 6 new assets

https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/mdvm · api · max severity critical · since 2026-09-16
https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/pns · api · max severity high · since 2026-09-16
https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/rwsca · api · max severity critical · since 2026-09-16
https://wallet-backend-sandbox.apps.sandbox.nwb.youniqx.com/v1/wpb · api · max severity critical · since 2026-09-16
2 scope items described in words
- d-you Wallet Android Test · mobile
- d-you Wallet iOS Test · other

New assets on existing programs

Faraday, Inc.

HackerOne · 2 new assets

BigQuery · other · max severity critical · since 2026-09-18
api.row.pro · url · max severity critical · since 2026-09-18

Infomaniak Bug Bounty program

YesWeHack · up to $ 7,000 · 5 new assets

ksuite.infomaniak.com/*/kdrive/*/preview/* · url · since 2026-09-18
4 listed on apps.apple.com
- https://apps.apple.com/fr/app/infomaniak-authenticator/id1478424817 · mobile
- https://apps.apple.com/fr/app/infomaniak-euria/id6754152858 · mobile
- https://apps.apple.com/fr/app/infomaniak-kchat/id6443845553 · mobile
- https://apps.apple.com/fr/app/infomaniak-swisstransfer/id6737686335 · mobile

Bolt Technology OÜ

Bugcrowd · up to $6,500 · 1 new asset

https://*.boltable.eu · url · since 2026-09-14

Superbank - Public Bug Bounty Program

YesWeHack · up to $ 2,000 · 1 new asset

http://chatbot.super-id.net · other · since 2026-09-14

Files.com

HackerOne · 1 new asset · 3 publicly disclosed reports, most often: Cross-Site Request Forgery (CSRF) (1), Information Disclosure (1)

your-assigned-subdomain.hosted-by-files.com · url · max severity critical · since 2026-09-16

Flutter UK&I

HackerOne · 1 new asset

metrocompetitions.com · url · max severity critical · since 2026-09-16

hostinger

HackerOne · 1 new asset · 7 publicly disclosed reports, most often: Improper Access Control - Generic (2), Cleartext Storage of Sensitive Information (1), Insecure Direct Object Reference (IDOR) (1)

H5G/Agency · other · max severity critical · since 2026-09-19

Superbet

HackerOne · 1 new asset

https://super.xyz · url · max severity low · since 2026-09-14

Ubiquiti Inc.

HackerOne · 2 new assets · 98 publicly disclosed reports, most often: Command Injection - Generic (15), Cross-site Scripting (XSS) - Generic (12), Privilege Escalation (9)

UniFi-Play · device · max severity medium · since 2026-09-15
1 scope item described in words
- Enterprise Audio/Video · device

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.