Work at Canva? Claim it to respond to reviews as the verified owner.
Found a vulnerability?
If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.
Ask BugRater to submit itPrivate. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.
Reviews
0 publishedNo reviews yet.
Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 3 Oct 2026.
Canva empowers users to design anything and publish anywhere, utilizing our versatile web and mobile apps. Our platform supports both online and physical publishing integrations, offering a wide range of options for your creative projects. Users trust Canva with their personal content, business promotions, product information, media assets, and more. While Canva is available for free, we also offer a Pro subscription that provides access to premium media resources like extensive image libraries. Additionally, our Canva Teams product offers brand kits, digital asset management, and access-control functionality. We prioritize the security of our systems and deeply value the contributions of the security researcher community. Your responsible disclosure of security vulnerabilities is crucial in helping us maintain the security and privacy of our users.
Scope
18 assets| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| *.canva-apps.cn | website | ✓ bounty | not set |
| *.canva-apps.com | website | ✓ bounty | not set |
| *.canva.cn | website | ✓ bounty | not set |
| *.canva.com | website | ✓ bounty | not set |
| *.canva.tech | website | ✓ bounty | not set |
Show all 18 assets
| Asset | Type | Eligibility | Max severity |
|---|---|---|---|
| api.canva.com | api | ✓ bounty | not set |
| Apps SDK Sandboxing | other | ✓ bounty | not set |
| Canva (Android) | android | ✓ bounty | not set |
| Canva (Chrome Extension) | other | ✓ bounty | not set |
| Canva (iOS) | ios | ✓ bounty | not set |
| Canva Desktop (macOS / Windows) | other | ✓ bounty | not set |
| Canva Developer Portal | website | ✓ bounty | not set |
| Canva for ChatGPT | website | ✓ bounty | not set |
| Canva for Slack | website | ✓ bounty | not set |
| www.canva.com | website | ✓ bounty | not set |
| 3rd-Party Provider Vulnerability | other | submit only | not set |
| Leaked Credentials and Secrets (Canva Employee/Contractor) | other | submit only | not set |
| Leaked Credentials and Secrets (Canva User) | other | submit only | not set |