New in bug bounty scope: week 43, 2026

Oct 19 to Oct 25, 2026 · published 2026-11-03

27 assets newly entered public bug-bounty scope in week 43 of 2026 (Oct 19 to Oct 25, 2026) on 13 programs: Early Warning, Fluvius, Banco Plata, Social Deal and 9 more. Each asset was checked against its program's own scope history: 21 raw additions that week were assets put back after a removal and 1 were renames, so they are not listed. Only assets still in scope when this digest was published (2026-11-03) are shown. This is the weekly record: new programs and domains draw a rush within days, so for time-sensitive hunting use the feed or new_in_scope live.

New programs

Fluvius

Intigriti · up to EUR 5,500 · 3 new assets

• https://over.fluvius.be · url · max severity Tier 2 · since 2026-10-19
• www-a.fluvius.be · url · max severity No Bounty · since 2026-10-19
• www.fluvius.be · url · max severity Tier 2 · since 2026-10-19

New assets on existing programs

Banco Plata

HackerOne · 3 new assets

• people.plata.team · url · max severity critical · since 2026-10-20
• plata.co · url · max severity critical · since 2026-10-20
• prime.plata.co · api · max severity critical · since 2026-10-20

Social Deal

Intigriti · up to EUR 1,000 · 3 new assets

• https://www.spontaan.nl/ · url · max severity Tier 2 · since 2026-10-19
• www.socialdeal.nl/blog/ · url · max severity Tier 1 · since 2026-10-19
• 1 scope item described in words

  • Social Deal IOS APP · mobile

Databricks

HackerOne · 2 new assets

• login.databricks.com · url · max severity critical · since 2026-10-23
• ui-assets.cloud.databricks.com · url · max severity critical · since 2026-10-23

T-Mobile

Bugcrowd · up to $133,700 · 1 new asset

• http://10.72.218.66/flag.txt · ip · since 2026-10-20

Binance

Bugcrowd · up to $10,000 · 1 new asset

• https://binance.th/ · url · since 2026-10-22

Infomaniak Bug Bounty program

YesWeHack · up to $ 7,000 · 1 new asset

• https://github.com/Infomaniak/desktop-kChat · other · since 2026-10-22

Nexuzhealth Web PACS

Intigriti · up to EUR 1,000 · 1 new asset

• idp-url.nexuzhealth.be · url · max severity Tier 2 · since 2026-10-23

MoonPay

HackerOne · 1 new asset

• *.dflow.net · wildcard · max severity critical · since 2026-10-21

Vercel

HackerOne · 1 new asset · 1 publicly disclosed report, most often: Access Control Check Implemented After Asset is Accessed (1)

• https://github.com/sveltejs/kit · source · max severity critical · since 2026-10-21

Visa

HackerOne · 1 new asset

• https://ebc2test.cybersource.com/settings · url · max severity critical · since 2026-10-23

Early Warning

HackerOne · 8 new assets

• 8 named under *.earlywarning.com, already in scope

  • accountinfodirect-snd.earlywarning.com · url
  • accountinfodirect.earlywarning.com · url
  • aoa-ws-fis.earlywarning.com · url
  • https://accountinfo.earlywarning.com · url
  • https://aoa-ws-direct-snd.earlywarning.com/aoainquiryservice/services/aoainquiryservice · url
  • https://aoa-ws-direct.earlywarning.com/aoainquiryservice/services/aoainquiryservice · url
  • https://aoa-ws.earlywarning.com/aoainquiryservice/services/aoainquiryservice · url
  • inquirydirect.earlywarning.com · url

GoCardless Bug Bounty Program

HackerOne · 1 new asset

• 1 named under *.gocardless.com, already in scope

  • docs.gocardless.com · url

← previous week · all weeks · next week →

An AI agent can get this live, with each host's fingerprinted stack and the published advisories for newly added code repositories, through the vulntel MCP server: new_in_scope(days=7). See the tools.