Bug bounty program


  • We will only pay out for disclosures in scope
  • Duplicates will not be accepted, you must be the first person to report the vulnerability
  • We cannot pay out to sanctioned regions
  • Do not access or test our production instance


  • Only https://staging-2.canvasapp.com/ is in scope. Do not test or attack our production environment.
  • Issues that significantly affect confidentiality or integrity of user data

Out of scope

  • Production canvasapp.com
  • Marketing content, docs, blog content
  • Output from automated scanners
  • No load testing (DoS, DDoS)
  • Self-XSS
  • Social engineering
  • Issues that only affect unsupported browsers (e.g. IE6)
  • Missing or incorrect SPF, DMARC, DKIM records
  • Cookie duration
  • Widely-known vulnerabilities in libraries, including public zero-days
  • Exploits that require user action (e.g. in-browser dev tools)
  • Missing HTTP headers
  • Clickjacking
  • Information disclosure of non-user data
  • CSRF on anonymous forms
  • CSRF attacks that require knowledge of the CSRF token
  • Public key disclosure
  • Issues with third-party services
  • UI/UX issues that do not impact security
  • Attacks that require MITM
  • SSL/TLS best practices
  • Any other trivial bugs


  • P1: $200
  • P2: $100
  • P3: $50
  • P4: $25


  1. Email security@canvasapp.com with the details, steps to reproduce and proof of concept
  2. If your disclosure is accepted, you will receive further instructions.
  3. If accepted, you will need to provide Form W-9/W-8BEN before your payout can be processed.
© 2024 Infinite Canvas Inc.
Twitter logo
LinkedIn logo
Spotify logo