Security

If you believe you have found a potential security issue, please send it to us through the Support page. A useful report includes:

• A clear description of the potential issue.
• The minimal safe reproduction information you already have — not a full walkthrough built by testing further.
• The realistic impact, as best you can tell.
• The date you found it.
• A way for us to reach you.

If you already possess information about a potential issue, please send us what you already have. Please do not continue testing, verifying, scanning, exploiting, or reproducing it further, and do not access or view any additional accounts or data to prove it. Sending what you already know is enough for us to look into it.

This page does not authorize security testing against WorkRadar Canada. To keep real candidates, employers, and their data safe, we ask that you do not:

• Access, view, copy, or download another person's account or private data.
• Bypass authentication, email verification, or role/company access controls.
• Bypass payment controls, or test Stripe or other payment flows without our written permission.
• Attempt privilege escalation against real accounts.
• Modify, delete, or publish any data.
• Guess passwords or perform credential stuffing.
• Run automated abuse, scanning, fuzzing, or load testing.
• Attempt to disrupt or degrade WorkRadar Canada's availability (DoS/DDoS).

If you have already identified an issue, please do not continue testing merely to prove it further, and please do not reproduce it against real users or real data.

WorkRadar Canada does not operate a public bug bounty program, and does not guarantee a reward, compensation, payment, or reimbursement for any report. Any recognition or compensation, if WorkRadar Canada ever chooses to consider it, is entirely discretionary and does not create an obligation.

WorkRadar Canada may review a report, but does not promise a response time, confirmation that a report is valid, a remediation timeline, or compensation of any kind.