Sprinklr, Inc
Vulnerability disclosure program on security.txt sprinklr.com
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 2
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- [email protected]
- Full safe harbor
- Good-faith research is authorised; no legal action.
- No public write-ups
- Keep findings private.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Safe harbor
-
Full
Any activities conducted in a manner consistent with this policy will be considered authorized conduct and we will not initiate legal action against you.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
2 assets you may test, 29 excluded.
Domains 1
- sprinklr.com
Products and areas 1
- Other domains owned by Sprinklr, Inc
Out of scope (29)
- Any activity that could lead to the disruption of our service (DoS)
- Attacks requiring MITM or physical access to a user's device
- Cache Poisoning
- CAPTCHAs missing as a Security protection mechanism
- Clickjacking on pages with no sensitive actions
- Comma Separated Values (CSV) injection without demonstrating a vulnerability
- Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
- Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
- HttpOnly or Secure flags on cookies
- Issues that require unlikely user interaction
- Missing best practices in Content Security Policy
- Missing best practices in SSL/TLS configuration
- Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc)
- Open redirect - unless an additional security impact can be demonstrated
- Previously known vulnerable libraries without a working Proof of Concept
- Rate limiting or bruteforce issues on non-authentication endpoints
- Security headers/attributes missing such as, but not limited to “content-type-options”, “X-XSS-Protection”
- Self-type Cross Site Scripting / Self-XSS
- Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors)
- Tabnabbing
- UI and UX bugs and spelling mistakes
- Use of a known-vulnerable library without proof of exploitability;
- Username enumeration
- Vulnerabilities contingent on physical attack, social engineering, spamming, DDOS attacks, etc
- Vulnerabilities in third-party software, libraries and code
- Vulnerabilities only affecting users of outdated or unpatched browsers [Less than 2 stable versions behind the latest released stable version]
- Vulnerabilities on sites hosted by third parties unless they lead to a vulnerability on the main website
- Vulnerabilities relying highly on social engineering aspect
- Vulnerabilities relying on the existence of plugins such as Flash
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sprinklr, Inc's policy. "We" in these lines means the program, not this site.
While testing
-
While performing the research there should not be any disruption of systems, privacy violations and degradation to user experience.
-
DO NOT report a security vulnerability to any other Sprinklr’s partner, client, employee and email.
-
DDoS attacks DO NOT qualify under this program and website should not be tested against such attacks.
-
Information about the vulnerability should not be disclosed publicly.
-
Information about finding a vulnerability also should not be disclosed publicly.
-
The researcher should not put the screenshots, videos, screen grabs or any other sensitive information regarding the vulnerability on any external websites like Imgur, Vimeo, YouTube, Dropbox, etc.
-
Violation of the stated policy (both general guidelines and program policy) can result in enforcement of necessary legal actions.
Not accepted
-
Clickjacking on pages with no sensitive actions
-
UI and UX bugs and spelling mistakes
-
Cross-Site Request Forgery (CSRF) on unauthenticated forms or forms with no sensitive actions
-
Attacks requiring MITM or physical access to a user's device
-
Previously known vulnerable libraries without a working Proof of Concept
-
Comma Separated Values (CSV) injection without demonstrating a vulnerability
-
Missing best practices in SSL/TLS configuration
-
Any activity that could lead to the disruption of our service (DoS)
-
Content spoofing and text injection issues without showing an attack vector/without being able to modify HTML/CSS
-
Rate limiting or bruteforce issues on non-authentication endpoints
-
Missing best practices in Content Security Policy
-
HttpOnly or Secure flags on cookies
-
Missing email best practices (Invalid, incomplete or missing SPF/DKIM/DMARC records, etc)
-
Software version disclosure / Banner identification issues / Descriptive error messages or headers (e.g. stack traces, application or server errors)
-
Tabnabbing
-
Open redirect - unless an additional security impact can be demonstrated
-
Issues that require unlikely user interaction
-
Vulnerabilities relying highly on social engineering aspect
-
Username enumeration
-
Vulnerabilities relying on the existence of plugins such as Flash
-
CAPTCHAs missing as a Security protection mechanism
-
Use of a known-vulnerable library without proof of exploitability;
-
Vulnerabilities in third-party software, libraries and code
-
Self-type Cross Site Scripting / Self-XSS
-
Cache Poisoning
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.