Does Canada Post - Responsible Disclosure Program have a bug bounty program?

Canada Post - Responsible Disclosure Program runs a public vulnerability disclosure program (VDP) on Intigriti. It accepts good-faith security reports but does not offer cash rewards. It lists 6 in-scope assets.

bounty.index

Featured on

Ship notes · new platforms · outagesFollow @TheV_Stack for bounty.index updates

programs/Intigriti/innovapost

Canada Post - Responsible Disclosure Program

Intigriti·updated 10h ago

vdpopen

Discord → RSS

payout: no bounty
scope: 6 in · 0 out
safe harbor: unknown
response: no reports

open program

hunt score

vdpfresh

formula →

payout

0/55

bounty

0/20

freshness

25/25

how we sort the index, not an estimate of what you’ll earn

Attack surface

6 in-scope

4wildcards
1ios
1android

Scope

In scope

006

wildcards04

+*.canadapost-postescanada.cascope· No Bounty
+*.infopost.cascope· No Bounty
+*.postescanada-canadapost.cascope· No Bounty
+*.azcpggpc.cascope· No Bounty

android01

+com.canadapost.android· No Bounty

ios01

+394391577· No Bounty

Out of scope

000

none listed

Change history

1 event

2026-08-06
first indexed
90d ago · 6 in-scope assets

// only one snapshot on record, changes appear from the next ingest onward

Community reports

0 reports

No reports yet. Be the first to share your triage timing for Canada Post - Responsible Disclosure Program.

// peer-sourced response times. platforms won’t publish this, hunters can. anonymized in aggregate.

Your notes

▸ raw source payload

{
  "id": "0083a5bf-e54f-4f79-a972-12a795272c8b",
  "url": "https://www.intigriti.com/programs/innovapost/innovapost/detail",
  "name": "Canada Post - Responsible Disclosure Program",
  "handle": "innovapost",
  "status": "open",
  "targets": {
    "in_scope": [
      {
        "type": "wildcard",
        "impact": "No Bounty",
        "endpoint": "*.azcpggpc.ca",
        "description": "Any subdomain of azcpggpc.ca (eg. alert-management-svc.prd01.retail-api.azcpggpc.ca)"
      },
      {
        "type": "wildcard",
        "impact": "No Bounty",
        "endpoint": "*.canadapost-postescanada.ca",
        "description": "Any subdomain of canadapost-postescanada.ca (eg. www.canadapost-postescanada.ca, sso-osu.canadapost-postescanada.ca and store.canadapost-postescanada.ca)"
      },
      {
        "type": "wildcard",
        "impact": "No Bounty",
        "endpoint": "*.infopost.ca",
        "description": "Any subdomain of infopost.ca (eg. www.infopost.ca and dev.infopost.ca)"
      },
      {
        "type": "wildcard",
        "impact": "No Bounty",
        "endpoint": "*.postescanada-canadapost.ca",
        "description": "Any subdomain of postescanada-canadapost.ca (eg. www.postescanada-canadapost.ca)"
      },
      {
        "type": "ios",
        "impact": "No Bounty",
        "endpoint": "394391577",
        "description": "Canada Post's mobile application for iOS"
      },
      {
        "type": "android",
        "impact": "No Bounty",
        "endpoint": "com.canadapost.android",
        "description": "Canada Post's mobile application for Android"
      }
    ],
    "out_of_scope": []
  },
  "max_bounty": {
    "value": 0,
    "currency": "EUR"
  },
  "min_bounty": {
    "value": 0,
    "currency": "EUR"
  },
  "tacRequired": false,
  "company_handle": "innovapost",
  "twoFactorRequired": false,
  "confidentiality_level": "public"
}