Security & Responsible Disclosure

To report a security issue to Canvas please encrypt your message with our public key and send an email to

If you are unsure how to encrypt a message with our public key you may use

We endeavor to respond within 24 hours.

We acknowledge individuals who report security issues responsibly and may reward a bounty at our discretion.

If you are a security researcher looking at Canvas please contact us for details of our staging environment–it is identical to our production environment and if you find an issue there you will not risk seeing protected health information.