61,676 Bug Bounty Assets and 54 New Assets: Reading Coverage Flags Instead of Inventories

Search engines expose boolean filters that look like they should answer big questions: which assets belong to bug bounty programs, and which were discovered recently. In practice these flags answer narrower questions, and the difference shapes what they can support in an exposure report.

The measurements

On 20 October 2026, between 22:33 and 22:37 UTC, queries with sub_type="all" and a page size of one record returned:

Neither boolean is a population estimate. Both are useful in specific, narrower ways.

What is_bugbounty actually tells you

A tag indicating that an asset belongs to a bug bounty program means the scanning service has matched the host to a known program's scope. That is a statement about scope publication, not about security posture.

The practical uses are limited but real:

• An organization that runs a bug bounty program can check whether hosts it believed were internal appear in the program-tagged population.
• A host appearing in that set when the organization has no program indicates a scope definition error, which is a governance finding.
• Conversely, a host the organization believes is in scope but that the engine does not tag suggests a scope that is not machine-readable, which limits researcher access to it.

None of those is a vulnerability finding. All of them are easier to resolve than most exposure questions, because the answer exists in a document.

Why is_new is far smaller than expected

The is_new filter is documented as newly discovered within seven days. A count of 54 across an entire global scan corpus seems implausibly small for any seven-day period.

Two explanations are plausible and both point away from the number being a global new-asset census. The first is that the flag reflects a specific discovery pipeline whose definition is narrower than its name suggests. The second is that the tag is applied conservatively, only to assets whose first observation meets particular conditions.

Either way, a count of 54 cannot be used to estimate how much new internet-facing infrastructure appeared in a week.

This is a recurring pattern in exposure data: a flag named for a concept does not necessarily measure the concept. The discipline is to read the definition before reading the count.

Where flags add genuine value

The strongest use of a boolean flag is as a cross-check on an assumption.

For example: an organization completes an acquisition and inherits a set of domains. It believes the acquired systems are unknown to external parties. A query restricted to the acquired address space, combined with the bug bounty flag, would show whether those hosts appear in public program scopes — meaning researchers and therefore attackers already know about them.

That is a small, specific, answerable question. It is far more useful than a global count, and it takes minutes to run.

The broader principle

A large exposure dataset supports three kinds of statements: how many assets match a given definition, how a population changed between two measurements with identical definitions, and whether a specific host appears in a set.

It does not support statements about the total security posture of a population, about new infrastructure growth over a short interval, or about whether a specific technology is safe to deploy.

The boolean flags in this measurement round illustrate the point precisely. Each is a definition with a narrow application, and each becomes misleading the moment its scope is stretched.

References

• ZoomEye, search interface and field documentation, queried 20 October 2026 for the dorks listed above.
• CISA, Known Exploited Vulnerabilities Catalog.