Hi all, I am new here and was hoping you could help. I am a product manager and we are looking to enable our embedded reports in our application. One of my engineers reported a potential issue during testing. In short, we confirmed that any logged-in user can extract the short-lived ThoughtSpot auth token from browser network traffic and use it to call the ThoughtSpot REST API directly (e.g., metadata/search), effectively bypassing the org-level filter we rely on to keep customer data separated. While this token is not the long-lived service account credential, it does grant temporary access to production ThoughtSpot data. As I understand it, a motivated user could potentially query ThoughtSpot outside the intended embedded experience and risk cross-org data exposure, which makes our current embed approach unsafe. Is there any way to mitigate this risk?

message has been deleted

Could you please raise a support case for this, and the respective team will provide you solution as soon as possible?

Hi @Jordan A! Great question — this is something that often comes up when teams start working with embedded analytics. If the token belongs to a specific logged-in user, its scope is strictly limited to that user’s permissions in ThoughtSpot. In other words, even if someone extracts the short-lived auth token from network traffic, they can only access data and perform actions that the user is already authorized for. They won’t be able to perform cross-org operations or access other customers’ data unless their account has explicitly been granted those permissions — which should not be the case in a properly configured multi-tenant setup. To mitigate risk and ensure safety: • Make sure each user is assigned least-privilege access (only what they truly need) • Use row-level security (RLS) or similar mechanisms to enforce tenant-level data isolation • Avoid over-permissioning shared or embedded users With the right permission model in place, extracting the token does not increase access beyond what the user already has, so your embedded approach remains secure.