Polestar
By Polestar Performance AB Vulnerability disclosure program on Self-hosted polestar.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 9
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Replies within 3 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Response
-
Within 3 days
First response 3 business days
- Hall of fame
-
Yes
Polestar wishes to thank and acknowledge the security researchers who are the first to identify vulnerabilities.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
9 assets you may test, 1 excluded.
Android apps 1
- Mobile applications interacting with vehicles
APIs 1
- Backend APIs supporting vehicle services
Domains 1
- polestar.com
Hardware and IoT 1
- All Polestar-branded vehicles, including: All models and model years
Wildcard domains 1
- *.polestar.com
Products and areas 4
- All Polestar-branded vehicles, including infotainment, telematics and connectivity services
- Infotainment systems
- Mobile applications interacting with vehicles
- Telematics and connectivity services
Out of scope (1)
- Third-party websites: Domains registered to Polestar, but hosted by a third party.
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Polestar's policy.
While testing
-
You may publish and discuss the Vulnerability only after receiving notice that the Vulnerability is fixed, subject to the prior written consent of Polestar, which shall not be unreasonably withheld.
-
Any publication shall not name Polestar or reveal any Confidential Information.
Not accepted
-
Security issues/best practices that can’t be exploited with real impact
-
Social engineering Polestar employees, contractors, or customers
-
Denial of Service attack
-
Email Spoofing
-
Missing HTTP security headers, unless accompanied by a detailed proof of concept exploit that leverages their absence
-
Use of a library with known vulnerabilities (without evidence of further exploitation)
-
Reports of insecure SSL /TLS ciphers or weak signature algorithms, unless accompanied by a working proof of concept of an exploit
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.