Government of Alberta
Vulnerability disclosure program on security.txt alberta.ca
- Top reward
- No cash rewards
- Top severity paid
- Not published
- Assets in scope
- 3
- Public CVEs
- 2
- Last change
- No changes yet
At a glance
What to know before you start testing.
- No cash rewards
- A disclosure program: you report for credit, not money.
- Report by email
- https://www.alberta.ca/vulnerability-reporting-program.aspx
- Full safe harbor
- Good-faith research is authorised; no legal action.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What the company's own policy page says it pays.
This program does not pay cash rewards.
- Safe harbor
-
Full
Unless required by law, if you make a good faith effort to comply with this standard during your security research, we will consider your research to be authorized and we will work with you to understand and resolve the issue quickly.
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
3 assets you may test, 2 excluded.
Domains 1
- alberta.ca
Wildcard domains 1
- domains and sub-domains of alberta.ca
Products and areas 1
- any website published with a link to this policy
Out of scope (2)
- non-Government of Alberta systems from our vendors
- Websites not explicitly listed here or published with a link to this policy
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Government of Alberta's policy. "We" in these lines means the program, not this site.
While testing
-
notify us as soon as possible after you discover a real or potential security issue
-
make every effort to avoid privacy violations, degradation of user experience, disruption to production systems, and destruction or manipulation of data
-
provide us a reasonable amount of time to resolve the issue before you disclose it publicly
-
you do not intentionally compromise the privacy or safety of Government of Alberta personnel (employees or contractors), or any third parties
-
you do not intentionally compromise the intellectual property or other commercial or financial interests of any Government of Alberta personnel or entities, or any third parties
-
test any system other than the systems set forth in the ‘Scope’ section above
-
engage in physical testing of facilities or resources
-
engage in social engineering
Summarised with AI from the company's policy, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 3 hours ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
| CVE | Summary | Severity | Published |
|---|---|---|---|
| CVE-2020-12856 | OpenTrace, as used in COVIDSafe through v1.0.17, TraceTogether, ABTraceTogether, and other applications on iOS and Android, allows remote attackers to conduct long-term re-identification attacks and possibly have unspecified other impact, because of how Bluetooth is used. | Critical 9.8 | 18 May 2020 |
| CVE-2020-12717 | The COVIDSafe (Australia) app 1.0 and 1.1 for iOS allows a remote attacker to crash the app, and consequently interfere with COVID-19 contact tracing, via a Bluetooth advertisement containing manufacturer data that is too short. This occurs because of an erroneous OpenTrace manuData.subdata call. The ABTraceTogether (Alberta), ProteGO (Poland), and TraceTogether (Singapore) apps were also affected | Medium 6.5 | 14 May 2020 |