submit bug report: https://www.canva.com/security/bug-bounty/Bug Bounty Program
We invite security researchers to investigate vulnerabilities in Canva, so long as your research follows this responsible research and disclosure policy.
What you need to do
Avoid harm or risk to Canva, our users, or third parties.
This is common sense, but guidelines can be found below on what we’re not looking for.
Report through a legitimate channel.
This includes our bug bounty program or the form below.
Don’t disclose without our agreement.
Keep information about potential vulnerabilities confidential between yourself and Canva until Canva has verified the vulnerability, and has then had at least 90 days to resolve it.
