Report a Security Vulnerability
Effective Date: September 1, 2026
If you have found a security problem in a Canvas USA® website or service, we want to hear from you, and we will not come after you for telling us.
How to report it
Email [email protected] with "Security" in the subject line. Please include:
• Where it is — the URL, the endpoint, or the part of the service
• What the issue is, and what an attacker could do with it
• Enough detail to reproduce it
• Whether you have told anyone else, and how long you intend to wait before publishing
• What the issue is, and what an attacker could do with it
• Enough detail to reproduce it
• Whether you have told anyone else, and how long you intend to wait before publishing
Write in whatever language you are comfortable in and do not worry about a formal template. A short clear email beats a long report we cannot follow.
What we will do
• Acknowledge your report within five business days.
• Tell you whether we can reproduce it, and what we think its severity is.
• Keep you updated while we fix it, and tell you when it is done.
• Credit you if you would like to be credited, and leave you out of it if you would not.
• Tell you whether we can reproduce it, and what we think its severity is.
• Keep you updated while we fix it, and tell you when it is done.
• Credit you if you would like to be credited, and leave you out of it if you would not.
We are a manufacturer, not a software company, and we do not run a paid bug-bounty program. What we offer is a straight answer, a real fix, and our thanks.
Our commitment to you
If you research in good faith and follow this page, we will not pursue legal action against you and we will not ask anyone else to. If a third party brings a claim about work that stayed within these lines, we will make it known that your research was authorized.
What to stay inside
• Do not access, modify, download or keep anyone's personal data. If you stumble on customer data, stop, and tell us what you saw so we can measure it — do not collect more to prove the point.
• Do not degrade the service. No denial of service, no load testing, no spam or brute forcing against live systems.
• Do not use social engineering against our team, our customers or our suppliers, and no physical attacks on our premises.
• Use only your own accounts and your own test data.
• Give us reasonable time to fix it before you publish — 90 days is the norm, and talk to us if you need it to move.
• Do not degrade the service. No denial of service, no load testing, no spam or brute forcing against live systems.
• Do not use social engineering against our team, our customers or our suppliers, and no physical attacks on our premises.
• Use only your own accounts and your own test data.
• Give us reasonable time to fix it before you publish — 90 days is the norm, and talk to us if you need it to move.
In scope
Websites and services operated by Canvas USA®, including our storefronts, our customer portal and our public API endpoints.
Out of scope: systems operated by our vendors — our ecommerce platform, our payment processor, our shipping carriers — which have their own disclosure programs and should be told directly. Also out of scope: findings from automated scanners with no demonstrated impact, missing best-practice headers with no exploit path, and anything requiring a rooted device or a stolen credential.
If it is not a security issue
For a broken page or an ordinary problem with an order, use Contact Us — it will get to the right people faster.