Canopy Vulnerability Disclosure

generated: '2026-09-05'
method: searched
probe: true
source: https://www.usecanopy.com/security
provider: Canopy Connect
providerId: canopy
program:
  published: true
  type: responsible-disclosure
  bug_bounty: false
  paid: false
  platform: null
  policy_url: https://www.usecanopy.com/security
  contact_email: security@usecanopy.com
  security_txt: null
  security_txt_note: >-
    /.well-known/security.txt returns 404 on usecanopy.com, www.usecanopy.com
    and docs.usecanopy.com (probed 2026-09-05). The policy exists only as HTML
    prose, so an automated scanner following RFC 9116 will not find it.
policy:
  quote: >-
    If you believe you've discovered a potential vulnerability, please let us
    know by emailing us at security@usecanopy.com.
  requirements:
    - Provide reasonable time to remediate before public disclosure.
    - Act in good faith, avoiding privacy violations and service disruption.
  out_of_scope:
    - Denial of service / DDoS
    - Spamming
    - Social engineering
    - Physical attacks against property or data centres
  safe_harbor_stated: false
  response_sla: null
  rewards: null
evidence:
  - source: https://www.usecanopy.com/security
    status: 200
    kind: disclosure page
    keywords:
      - vulnerability
      - responsible disclosure
      - security research
      - security@usecanopy.com
  - source: https://www.usecanopy.com/.well-known/security.txt
    status: 404
    kind: RFC 9116 probe (negative)
maintainers:
  - FN: Kin Lane
    email: kin@apievangelist.com