Vulnerability Disclosure Program (VDP)
VDPs are meant for responsibly reporting vulnerabilities you encounter — not for actively hunting for fame or reputation. Even if you're just starting out, consider focusing on rewarded bug bounty programs instead.
tbs-sct
20
In Scope
11
Out of Scope
In-Scope Assets (20)
| Asset | Category | Bounty | Quick Links | |
|---|---|---|---|---|
| *.cds-snc.ca | WILDCARD | No | ||
| *.digital.canada.ca | WILDCARD | No | ||
| *.notification.canada.ca | WILDCARD | No | ||
| *.numerique.canada.ca | WILDCARD | No | ||
| api.forms-formulaires.alpha.canada.ca | URL | No | ||
| api.login-connexion.canada.ca | URL | No | ||
| api.migration.login-connexion.canada.ca | URL | No | ||
| app.login-connexion.canada.ca | URL | No | ||
| app.migration.login-connexion.canada.ca | URL | No | ||
| articles.alpha.canada.ca | URL | No | ||
| auth.cdssandbox.xyz | URL | No | ||
| auth.forms-formulaires.alpha.canada.ca | URL | No | ||
| delivrance-verification.alpha.canada.ca | URL | No | ||
| design-system.alpha.canada.ca | URL | No | ||
| design-system.canada.ca | URL | No | ||
| forms-formulaires.alpha.canada.ca | URL | No | ||
| gciv-dvgc.alpha.canada.ca | URL | No | ||
| issue-verify.alpha.canada.ca | URL | No | ||
| talent.canada.ca | URL | No | ||
| validate-email.cdssandbox.xyz | URL | No |
Out-of-Scope Assets (11)
| Asset | Category | Bounty | |
|---|---|---|---|
| *.cdssandbox.xyz | WILDCARD | No | |
| All other assets | OTHER | No | |
| ai-answers.alpha.canada.ca | URL | No | |
| ai-answers.cdssandbox.xyz | URL | No | |
| auth.login-connexion.canada.ca | URL | No | |
| blawx.cdssandbox.xyz | URL | No | |
| feedback-collection.cdssandbox.xyz | URL | No | |
| feedback-viewer.cdssandbox.xyz | URL | No | |
| reponses-ia.alpha.canada.ca | URL | No | |
| reponses-ia.cdssandbox.xyz | URL | No | |
| strapi.cdssandbox.xyz | URL | No |
Scope Changes (80)
Sep 10, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | auth.login-connexion.canada.ca | URL | Out of Scope | 20:01 |
| Added | auth.forms-formulaires.alpha.canada.ca | URL | In Scope | 20:01 |
Sep 2, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | validate-email.cdssandbox.xyz | URL | In Scope | 19:01 |
| Added | api.forms-formulaires.alpha.canada.ca | URL | In Scope | 18:01 |
Aug 27, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | api.migration.login-connexion.canada.ca | URL | In Scope | 15:01 |
| Removed | app.signin-connexion.canada.ca | URL | In Scope | 15:01 |
| Added | api.login-connexion.canada.ca | URL | In Scope | 15:01 |
| Added | app.migration.login-connexion.canada.ca | URL | In Scope | 15:01 |
| Added | app.login-connexion.canada.ca | URL | In Scope | 15:01 |
| Added | app.login-connexion.canada.ca | URL | In Scope | 15:01 |
| Added | api.login-connexion.canada.ca | URL | In Scope | 15:01 |
| Added | app.migration.login-connexion.canada.ca | URL | In Scope | 15:01 |
| Added | api.migration.login-connexion.canada.ca | URL | In Scope | 15:01 |
| Removed | auth.signin-connexion.canada.ca | URL | In Scope | 15:01 |
| Removed | api.signin-connexion.canada.ca | URL | In Scope | 15:01 |
Aug 25, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | auth.cdssandbox.xyz | URL | In Scope | 18:01 |
| Added | auth.cdssandbox.xyz | URL | In Scope | 18:01 |
Jul 6, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | design-system.canada.ca | URL | In Scope | 21:40 |
| Added | design-system.canada.ca | URL | In Scope | 21:40 |
Jun 22, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Removed | *.cdssandbox.xyz | WILDCARD | Out of Scope | 13:41 |
Jun 19, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | feedback-viewer.cdssandbox.xyz | URL | Out of Scope | 21:28 |
| Added | feedback-collection.cdssandbox.xyz | URL | Out of Scope | 21:28 |
| Added | feedback-collection.cdssandbox.xyz | URL | Out of Scope | 21:28 |
| Added | feedback-viewer.cdssandbox.xyz | URL | Out of Scope | 21:28 |
Apr 30, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | reponses-ia.cdssandbox.xyz | URL | Out of Scope | 13:28 |
| Added | ai-answers.alpha.canada.ca | URL | Out of Scope | 13:28 |
| Added | reponses-ia.alpha.canada.ca | URL | Out of Scope | 13:28 |
| Added | ai-answers.cdssandbox.xyz | URL | Out of Scope | 13:28 |
| Added | reponses-ia.cdssandbox.xyz | URL | Out of Scope | 13:28 |
| Added | reponses-ia.alpha.canada.ca | URL | Out of Scope | 13:28 |
| Added | ai-answers.alpha.canada.ca | URL | Out of Scope | 13:28 |
| Added | ai-answers.cdssandbox.xyz | URL | Out of Scope | 13:28 |
Apr 21, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | articles.alpha.canada.ca | URL | In Scope | 13:23 |
| Added | forms-formulaires.alpha.canada.ca | URL | In Scope | 13:23 |
| Added | design-system.alpha.canada.ca | URL | In Scope | 13:23 |
| Added | talent.canada.ca | URL | In Scope | 13:23 |
| Added | design-system.alpha.canada.ca | URL | In Scope | 13:23 |
| Added | articles.alpha.canada.ca | URL | In Scope | 13:23 |
| Added | forms-formulaires.alpha.canada.ca | URL | In Scope | 13:23 |
| Added | talent.canada.ca | URL | In Scope | 13:23 |
| Removed | design-system.alpha.canada.ca | URL | In Scope | 07:22 |
| Removed | forms-formulaires.alpha.canada.ca | URL | In Scope | 07:22 |
| Removed | talent.canada.ca | URL | In Scope | 07:22 |
| Removed | articles.alpha.canada.ca | URL | In Scope | 07:22 |
Mar 27, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | strapi.cdssandbox.xyz | URL | Out of Scope | 19:23 |
| Added | strapi.cdssandbox.xyz | URL | Out of Scope | 19:23 |
Mar 11, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | all other assets | OTHER | Out of Scope | 11:40 |
| Added | all other assets | OTHER | Out of Scope | 11:40 |
Mar 9, 2026
| Change | Asset | Category | Scope | Time |
|---|---|---|---|---|
| Added | gciv-dvgc.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | *.digital.canada.ca | WILDCARD | In Scope | 20:40 |
| Added | talent.canada.ca | URL | In Scope | 20:40 |
| Added | blawx.cdssandbox.xyz | URL | Out of Scope | 20:40 |
| Added | issue-verify.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | delivrance-verification.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | gciv-dvgc.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | talent.canada.ca | URL | In Scope | 20:40 |
| Added | *.cdssandbox.xyz | WILDCARD | In Scope | 20:40 |
| Added | *.cds-snc.ca | WILDCARD | In Scope | 20:40 |
| Added | articles.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | *.digital.canada.ca | WILDCARD | In Scope | 20:40 |
| Added | *.notification.canada.ca | WILDCARD | In Scope | 20:40 |
| Added | forms-formulaires.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | blawx.cdssandbox.xyz | URL | Out of Scope | 20:40 |
| Added | *.numerique.canada.ca | WILDCARD | In Scope | 20:40 |
| Added | auth.signin-connexion.canada.ca | URL | In Scope | 20:40 |
| Added | api.signin-connexion.canada.ca | URL | In Scope | 20:40 |
| Added | app.signin-connexion.canada.ca | URL | In Scope | 20:40 |
| Added | design-system.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | *.numerique.canada.ca | WILDCARD | In Scope | 20:40 |
| Added | *.notification.canada.ca | WILDCARD | In Scope | 20:40 |
| Added | *.cdssandbox.xyz | WILDCARD | In Scope | 20:40 |
| Added | *.cds-snc.ca | WILDCARD | In Scope | 20:40 |
| Added | design-system.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | articles.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | forms-formulaires.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | auth.signin-connexion.canada.ca | URL | In Scope | 20:40 |
| Added | app.signin-connexion.canada.ca | URL | In Scope | 20:40 |
| Added | api.signin-connexion.canada.ca | URL | In Scope | 20:40 |
| Added | issue-verify.alpha.canada.ca | URL | In Scope | 20:40 |
| Added | delivrance-verification.alpha.canada.ca | URL | In Scope | 20:40 |