Bug bounty program
Rules
We will only pay out for disclosures in scope
Duplicates will not be accepted, you must be the first person to report the vulnerability
We cannot pay out to sanctioned regions
Do not access or test our production instance
Scope
Only https://staging-2.canvasapp.com/ is in scope. Do not test or attack our production environment.
Issues that significantly affect confidentiality or integrity of user data
Out of scope
Production canvasapp.com
Marketing content, docs, blog content
Output from automated scanners
No load testing (DoS, DDoS)
Self-XSS
Social engineering
Issues that only affect unsupported browsers (e.g. IE6)
Missing or incorrect SPF, DMARC, DKIM records
DNSSEC
Cookie duration
Widely-known vulnerabilities in libraries, including public zero-days
Exploits that require user action (e.g. in browser dev tools)
Missing HTTP headers
Clickjacking
Information disclosure of non-user data
CSRF on anonymous forms
CSRF attacks that require knowledge of the CSRF token
Public key disclosure
Issues with third-party services
UI/UX issues that do not impact security
Attacks that require MITM
SSL/TLS best practices
Any other trivial bugs
Payouts
P1: $200
P2: $100
P3: $50
P4: $25
Disclosure
Email security@canvasapp.com with the details, steps to reproduce and proof of concept
If your disclosure is accepted, you will receive further instructions.
If accepted, you will need to provide Form W-9/W-8BEN before your payout can be processed.
Last updated