H1 HackerOne LIVE
Treasury Board of Canada Secretariat/Secrétariat du Conseil du Trésor du Canada
no bountyVDP
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.tbs-sct.canada.ca/
- managed triage
- yes
- response efficiency
- 68%
- first response
- 14h avg
20 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
api.forms-formulaires.alpha.canada.ca | domain | no | critical | 2026-09-20 |
api.login-connexion.canada.ca | domain | no | critical | 2026-09-20 |
api.migration.login-connexion.canada.ca | domain | no | critical | 2026-09-20 |
app.login-connexion.canada.ca | domain | no | critical | 2026-09-20 |
app.migration.login-connexion.canada.ca | domain | no | critical | 2026-09-20 |
articles.alpha.canada.ca | domain | no | critical | 2026-09-20 |
auth.cdssandbox.xyz | domain | no | critical | 2026-09-20 |
auth.forms-formulaires.alpha.canada.ca | domain | no | critical | 2026-09-20 |
delivrance-verification.alpha.canada.ca | domain | no | critical | 2026-09-20 |
design-system.alpha.canada.ca | domain | no | critical | 2026-09-20 |
design-system.canada.ca | domain | no | critical | 2026-09-20 |
forms-formulaires.alpha.canada.ca | domain | no | critical | 2026-09-20 |
gciv-dvgc.alpha.canada.ca | domain | no | critical | 2026-09-20 |
issue-verify.alpha.canada.ca | domain | no | critical | 2026-09-20 |
talent.canada.ca | domain | no | critical | 2026-09-20 |
validate-email.cdssandbox.xyz | domain | no | critical | 2026-09-20 |
*.cds-snc.ca | wildcard | no | critical | 2026-09-20 |
*.digital.canada.ca | wildcard | no | critical | 2026-09-20 |
*.notification.canada.ca | wildcard | no | critical | 2026-09-20 |
*.numerique.canada.ca | wildcard | no | critical | 2026-09-20 |
11 out of scope — black ICE, don't touch
ai-answers.alpha.canada.cadomainai-answers.cdssandbox.xyzdomainauth.login-connexion.canada.cadomainblawx.cdssandbox.xyzdomainfeedback-collection.cdssandbox.xyzdomainfeedback-viewer.cdssandbox.xyzdomainreponses-ia.alpha.canada.cadomainreponses-ia.cdssandbox.xyzdomainstrapi.cdssandbox.xyzdomainAll other assetsother*.cdssandbox.xyzwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.