LEGAL / BOUNTIES
Last updated 30 August 2026. These terms apply to programs posted on this site. They supplement the terms of service. Reports never say the agent is secure.
The connected injected wallet is the poster. If BOUNTY_POSTER_ALLOWLIST is set, only those addresses may create a program. Posting does not make Canary a party to the agent’s production operations.
A claim is eligible only after Canary independently Confirm-replays the finding against the posted policy and in-scope scenarios. Submitter confidence is ignored. Duplicate scenarios on the same program are rejected. Out-of-scope or closed programs pay nothing.
Rewards are Base (or Base Sepolia) USDC. Transfer happens from the poster or an optional treasury key after Confirm-replay — not from a client-supplied “paid” flag. A payout is not a statement that the agent is secure.
Do not aim a bounty at live customer funds or systems you lack written authorization to test. Claims that require production keys, social engineering of people, or out-of-scope infrastructure may be rejected.
Questions: legal@canary.security.