Early access: the directory is still filling out, and every rating here is a reported experience.
NR Unrated
Canva
Canva Bugcrowd $200–$15,000
3 more reviews needed for a grade
Write a review Claim this company profile

Work at Canva? Claim it to respond to reviews as the verified owner.

Found a vulnerability?

If you would rather not deal with the vendor yourself, a BugRater analyst will submit it upstream on your behalf, with your explicit permission, and tell you what came back.

Ask BugRater to submit it

Private. The report body is encrypted at rest; BugRater holds the key, so the analyst working it can read it. Every read is logged.

Reviews

0 published

No reviews yet.

Be the first to review

Program profile Bugcrowd · imported

Facts published by Bugcrowd on the program's own page, not reported by researchers, and not part of the BugRater grade. Last checked 3 Oct 2026.

Canva empowers users to design anything and publish anywhere, utilizing our versatile web and mobile apps. Our platform supports both online and physical publishing integrations, offering a wide range of options for your creative projects. Users trust Canva with their personal content, business promotions, product information, media assets, and more. While Canva is available for free, we also offer a Pro subscription that provides access to premium media resources like extensive image libraries. Additionally, our Canva Teams product offers brand kits, digital asset management, and access-control functionality. We prioritize the security of our systems and deeply value the contributions of the security researcher community. Your responsible disclosure of security vulnerabilities is crucial in helping us maintain the security and privacy of our users.

Currency
USD
Submissions
Open
Scope entries
18 Bugcrowd’s count

Scope

18 assets
AssetTypeEligibilityMax severity
*.canva-apps.cn website ✓ bounty not set
*.canva-apps.com website ✓ bounty not set
*.canva.cn website ✓ bounty not set
*.canva.com website ✓ bounty not set
*.canva.tech website ✓ bounty not set
Show all 18 assets
AssetTypeEligibilityMax severity
api.canva.com api ✓ bounty not set
Apps SDK Sandboxing other ✓ bounty not set
Canva (Android) android ✓ bounty not set
Canva (Chrome Extension) other ✓ bounty not set
Canva (iOS) ios ✓ bounty not set
Canva Desktop (macOS / Windows) other ✓ bounty not set
Canva Developer Portal website ✓ bounty not set
Canva for ChatGPT website ✓ bounty not set
Canva for Slack website ✓ bounty not set
www.canva.com website ✓ bounty not set
3rd-Party Provider Vulnerability other submit only not set
Leaked Credentials and Secrets (Canva Employee/Contractor) other submit only not set
Leaked Credentials and Secrets (Canva User) other submit only not set