- Top reward
- No cash rewards
- Top severity paid
- Critical
- Assets in scope
- 14
- Public CVEs
- 0
- Last change
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report on HackerOne
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 2 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What HackerOne lists as the payout for each severity.
This program does not pay cash rewards.
- Response
-
Within 2 days
| First Response | 2 days |
- Safe harbor
-
Partial
Make a good faith effort to uphold applicable laws and regulations, avoid privacy violations, destruction of data, and interruption or degradation of our service and user experience.
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
14 assets you may test, 9 excluded.
Web 10
- api.singlestore.com Critical No bounty
- auth.singlestore.com Critical No bounty
- authsvc.singlestore.com Critical No bounty
- backend.singlestore.com Critical No bounty
- https://portal.singlestore.com Critical No bounty
- https://portal.singlestore.com/admin Critical No bounty
- mcp.singlestore.com Critical No bounty
- nimbus-gateway.singlestore.com Critical No bounty
- phone-home.singlestore.com Critical No bounty
- singlestore.com High No bounty
Desktop and binaries 2
- singlestoredb-server Critical No bounty
- singlestore-operator Critical No bounty
Wildcard domains 2
- *.cloud.singlestore.com Critical No bounty
- *.svc.singlestore.com Critical No bounty
Out of scope (9)
- bifrost.singlestore.com
- docs.singlestore.com
- login.internal.singlestore.com
- status.singlestore.com
- studio.singlestore.com
- support.singlestore.com
- training.singlestore.com
- *.ito.singlestore.com
- *.labs.singlestore.com
Rules
What the policy asks of you, and the bug types it won't reward, quoted from SingleStore (via HackerOne)'s policy. "We" in these lines means the program, not this site.
While testing
-
Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
-
Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
-
Only interact with accounts you own or with explicit permission of the account holder.
-
Carrying out testing on any customer workspace(s), cluster(s), or any other service that's clearly specifically attached to the customer's tenant or organization(s).
-
Social engineering activities (e.g. phishing, vishing, smishing).
-
Physical attacks against SingleStore's employees, contractors, our premises, or any of our service providers.
-
Adding the header `X-HackerOne-Research: [H1 username]` to HTTP requests;
-
Please also **avoid using Intercom's chat features available on our website or within the SingleStore Portal when testing**.
-
**Reports must be reproduced against the latest available patch version of the currently supported SingleStoreDB release;**
Not accepted
-
Clickjacking on pages with no sensitive actions
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
-
Attacks requiring MITM or physical access to a user's device
-
Previously known vulnerable libraries without a working Proof of Concept
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability
-
Missing best practices in SSL/TLS configuration
-
Any activity that could lead to the disruption of our service (DoS)
-
Rate limiting or bruteforce issues on non-authentication endpoints
-
Missing best practices in Content Security Policy
-
Missing HttpOnly or Secure flags on cookies
-
Configuration of or missing security headers
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.)
-
Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
-
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors)
-
Tabnabbing
-
Issues that require unlikely user interaction
-
Improper logout functionality and improper session timeout
-
CORS misconfiguration without an exploitation scenario
-
Broken link hijacking
-
Lack of SSL Pinning
-
Open redirect - unless an additional security impact can be demonstrated
-
Vulnerabilities that only affect end-of-life (EOL) or unsupported versions of SingleStoreDB
-
Vulnerabilities that affect older patch versions but are fixed in the latest supported release
-
Reports of publicly known CVEs that have already been addressed in current releases
-
Issues that require unrealistic attack conditions or privileged internal access not available to customers
Summarised with AI from the program policy on HackerOne, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Before we tracked it
Scope and reward changes recorded before this page started tracking it.
-
Scope added
*.cloud.singlestore.com
-
Scope added
*.svc.singlestore.com
-
Scope added
mcp.singlestore.com
-
Scope added
api-dev.singlestore.com
-
Scope added
authsvc-staging.singlestore.com
-
Scope added
backend-dev.singlestore.com
-
Scope added
https://portal-staging.dev.helios.singlestore.com/
-
Scope added
ai.*.svc.singlestore.com
-
Scope added
apps.*.svc.singlestore.com
-
Scope added
bottle-api.*.svc.singlestore.com
-
Scope added
bottle-dup.*.svc.singlestore.com
-
Scope added
cell-agent.*.svc.singlestore.com
-
Scope added
notebook-gateway.*.svc.singlestore.com
-
Scope added
nova-gateway.*.svc.singlestore.com
-
Scope added
singlestore-operator
-
Scope added
singlestoredb-server
-
Scope added
nimbus-gateway.singlestore.com
-
Scope added
phone-home.singlestore.com
-
Scope added
*.ito.singlestore.com (out of scope)
-
Scope added
*.labs.singlestore.com (out of scope)
-
Scope added
bifrost.singlestore.com (out of scope)
-
Scope added
docs.singlestore.com (out of scope)
-
Scope added
login.internal.singlestore.com (out of scope)
-
Scope added
status.singlestore.com (out of scope)
-
Scope added
studio.singlestore.com (out of scope)
-
Scope added
support.singlestore.com (out of scope)
-
Scope added
training.singlestore.com (out of scope)
-
Scope added
singlestore.com
-
Scope added
api.singlestore.com
-
Scope added
auth.singlestore.com
-
Scope added
authsvc.singlestore.com
-
Scope added
backend.singlestore.com
-
Scope added
https://portal.singlestore.com/
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from hackerone.com on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
About SingleStore
SingleStore is a distributed, relational database with optimized speed and scalability to support data-intensive and real-time applications. SingleStore has two distinct product types:
- SingleStore Helios is our DBaaS offering enabling customers to leverage a real-time data platform designed for all applications, analytics and AI - most items in scope of this program relate to this product offering;
- SingleStore Self-Managed for customers which intend to run our licensed database software on their own infrastructure.
More information about SingleStore and our products can be viewed on our website and in our documentation.
About our Responsible Disclosure Program
At SingleStore we appreciate the efforts and transparency of the security research community in responsibly disclosing vulnerabilities that may have slipped past us during our software development security practices. Should you find a vulnerability in one of our systems, we would prefer to hear about it as soon as possible so that we can perform our due diligence to protect our users, customers and businesses.
Program Rules
- Please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
- Follow HackerOne's disclosure guidelines.
- When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug.
- Please provide detailed reports with reproducible steps and any additional information or artifacts (such as screenshots and screen recordings) necessary for us to triage the finding correctly. If the report is not detailed enough to reproduce the issue, the issue may not be marked as triaged.
- Submit one vulnerability per report, unless you need to chain vulnerabilities to provide impact.
- When duplicates occur, we only triage the first report that was received (provided that it can be fully reproduced).
- Multiple vulnerabilities caused by one underlying issue will be treated as one valid report.
- Submitted reports containing verbatim output of automated security scans (e.g. Burp Suite, Nessus) will be disregarded.
- Make a good faith effort to uphold applicable laws and regulations, avoid privacy violations, destruction of data, and interruption or degradation of our service and user experience.
- Only interact with accounts you own or with explicit permission of the account holder.
- SingleStore does not provide any type of user credentials nor will we provision accounts for security researchers. Regardless, you are encouraged to sign up your own user accounts during testing for in-scope assets that allow user enrolment (see Testing section below).
The following activities are expressly prohibited:
- Carrying out testing on any customer workspace(s), cluster(s), or any other service that's clearly specifically attached to the customer's tenant or organization(s).
- Attempting to compromise or actually compromising in any way or form another user's account. Once again, please only interact with accounts you own or have explicit permission to leverage for testing.
- Social engineering activities (e.g. phishing, vishing, smishing).
- Physical attacks against SingleStore's employees, contractors, our premises, or any of our service providers.
- Knowingly sharing any type of malware with SingleStore or its employees.
- Carrying out any illegal, unethical or harmful practices on or through our platform, including but not limited to cryptomining, storing malicious content, illicit data or data meant to be used for illicit purposes, and similar type of activities.
Testing Etiquette
As part of your testing efforts, please add HackerOne identifiers in headers, usernames and emails whenever applicable, i.e.:
- Adding the header
X-HackerOne-Research: [H1 username]to HTTP requests; - Using your HackerOne email alias
[email protected]; - Using usernames prefixed or suffixed by clear identifiers, e.g.
user1-hackerone,user2-h1.
Please also avoid using Intercom's chat features available on our website or within the SingleStore Portal when testing. These channels connect directly to our internal support teams, and test-related activity in these environments may generate unnecessary noise and disrupt normal operations.
Instructions for Testing SingleStore Helios
You can self-register a SingleStore Helios account through Portal and either click "Sign Up" and fill-in the required fields or use one of the social logins buttons: Google or Microsoft. Once that's done, you can sign in on Portal into your newly created organization from which you can invite additional users, spin up workspaces and database clusters and experiment with features such as SingleStore Notebooks and SingleStore Kai.
Note that your user account in Portal will not work for the administrative SingleStore Portal (and it is not meant to).
Please refer to our Security Administration Docs for steps on how to manage users for organizations and database clusters.
For testing SingleStore's Management API (api.singlestore.com), you will need to generate an API key - you can do so through Portal. For detailed instructions refer to our Management API Docs.
Note that our product features a serverless platform for running containerized workloads accessible within Portal. While it is a product feature we're certainly interested in getting feedback from the ethical hacker community on its security maturity, we please ask you to first read through the SingleStore Aura's documentation before submitting reports so that you understand the context around this feature and minimize the number of reported false-positives.
Instructions for Testing SingleStore Self-Managed
SingleStore provides pre-built SingleStoreDB server images for customers deploying self-managed environments. These images are made available on DockerHub: https://hub.docker.com/r/memsql/node
For development and testing purposes, a separate image is available without commercial licensing restrictions: https://github.com/singlestore-labs/singlestoredb-dev-image
By using SingleStore Self-Managed software, you agree to the applicable Free/Trial License Terms. For full details, please refer to: https://www.singlestore.com/legal/
Additional information and alternative installation methods for self-managed deployments are available in the official documentation: https://docs.singlestore.com/db/v9.0/deploy.
Please take note of the following rules for Self-Managed Testing:
- Reports must be reproduced against the latest available patch version of the currently supported SingleStoreDB release;
- Vulnerabilities affecting third-party components must demonstrate a direct and realistic impact on SingleStoreDB, rather than reporting generic CVEs present in underlying dependencies.
Response Targets
SingleStore will make a best effort to meet the following response targets for hackers participating in our program:
| Type of Response | Target in business days |
|---|---|
| First Response | 2 days |
| Time to Triage | 10 days |
| Time to Resolution | depends on severity and complexity |
We’ll try to keep you informed about our progress throughout the process.
Scope Leniency
This program may sporadically accept submissions for assets that are not listed as explicitly in scope depending on their severity and complexity.
Out of scope vulnerabilities
- Clickjacking on pages with no sensitive actions;
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions;
- Attacks requiring MITM or physical access to a user's device;
- Previously known vulnerable libraries without a working Proof of Concept;
- Comma Separated Values (CSV) injection without demonstrating a vulnerability;
- Missing best practices in SSL/TLS configuration;
- Any activity that could lead to the disruption of our service (DoS);
- Rate limiting or bruteforce issues on non-authentication endpoints;
- Missing best practices in Content Security Policy;
- Missing HttpOnly or Secure flags on cookies;
- Configuration of or missing security headers;
- Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc.);
- Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version];
- Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors);
- Tabnabbing;
- Issues that require unlikely user interaction;
- Improper logout functionality and improper session timeout;
- CORS misconfiguration without an exploitation scenario;
- Broken link hijacking;
- Lack of SSL Pinning;
- Open redirect - unless an additional security impact can be demonstrated.
In addition to the above, the following list of exclusions applies for SingleStore Self-Managed testing:
- Vulnerabilities that only affect end-of-life (EOL) or unsupported versions of SingleStoreDB (see https://docs.singlestore.com/db/v9.0/support/singlestore-software-end-of-life-eol-policy/);
- Vulnerabilities that affect older patch versions but are fixed in the latest supported release;
- Reports of publicly known CVEs that have already been addressed in current releases;
- Issues that require unrealistic attack conditions or privileged internal access not available to customers;
- Security issues arising from user-controlled configuration, deployment, or operational practices. Reports must demonstrate a vulnerability in SingleStoreDB itself, not an issue caused by insecure or non-recommended configuration choices;
- Vulnerabilities specific to the development or testing container image provided at https://github.com/singlestore-labs/singlestoredb-dev-image. This image is provided for development and testing convenience and may include additional utilities, debugging tools, or a base OS that is not hardened for production use.
Thank you for helping keep SingleStore, our product, customers and userbase safe!