- Top reward
- $500
- Top severity paid
- Not published
- Assets in scope
- 12
- Public CVEs
- 1
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $500
- top reward.
- Report by email
- [email protected]
Rewards
What the company's own policy page says it pays.
The policy page has no reward table. Here is what it says, in its own words.
- Top reward
-
$500
At our discretion, ThoughtSpot may offer monetary rewards of up to $500 USD for valid, in-scope Critical vulnerability findings based on the severity, impact, and quality of the report.
- Legal protection
-
Stated
ThoughtSpot will not pursue legal action against those researchers that follow the below guidelines and responsibly disclose any security vulnerabilities directly to ThoughtSpot.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
12 assets you may test, 3 excluded.
Source code 3
- github.com
- https://github.com/thoughtspot
- Public Repositories
Android apps 2
- iOS and Android apps
- Mobile Applications
Wildcard domains 2
- *.thoughtspot.cloud
- *.thoughtspot.com
APIs 1
- REST APIs, Embedded Analytics, SpotDev
Domains 1
- authentication & sso
Products and areas 3
- Developer Platform
- ThoughtSpot Cloud
- Where ThoughtSpot controls the implementation
Out of scope (3)
- BigQuery
- Salesforce
- Snowflake
Changes
Tracked since 12 Nov 2026. Last checked 5 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2019-12782 | An authorization bypass vulnerability in pinboard updates in ThoughtSpot 4.4.1 through 5.1.1 (before 5.1.2) allows a low-privilege user with write access to at least one pinboard to corrupt pinboards of another user in the application by spoofing GUIDs in pinboard update requests, effectively deleting them. | High 8.1 | 9 Jul 2019 |