LPSPresta Software

Bug bounty program

Presta Software pays security researchers for valid vulnerabilities in the systems we own. The program opened on 1 November 2026 and runs continuously; the security lead, Marco Presta, triages every report personally.

Scope

In scope: prestasoftware.com, every subdomain of prestasoftware.com, and any other Internet-facing service we name on this page as owned and operated by Presta Software. Out of scope, always: systems of our clients or of any third party, Government of Canada sites, our suppliers' platforms (hosting, DNS, mail), denial of service, social engineering, physical access, and findings that need a stolen credential to reproduce.

Rewards (CAD)

  • Critical (remote code execution, full account or data compromise): 500
  • High (authentication bypass, stored injection, sensitive data exposure): 250
  • Medium (reflected injection, access-control gaps, security misconfiguration with impact): 100
  • Low (hardening gaps with a demonstrated path): 25

The yearly pool is CAD 2,000; the first valid report of an issue is the one paid; severity follows CVSS v4 as judged by us, duplicates and informational findings earn thanks and a name on this page if you wish. Paid by Interac e-Transfer or PayPal within 30 days of validation.

Rules and safe harbour

Research conducted in good faith, within this scope and these rules, is authorized: we will not pursue legal action against you for it and we will say so to anyone who asks. Keep traffic reasonable (no flooding), stop and report as soon as you can show impact, never read, alter or keep data that is not yours, and give us 90 days before any disclosure. Report to [email protected] with steps to reproduce; our machine-readable contact is /.well-known/security.txt. We acknowledge within 2 business days and triage within 10.

Not eligible: Presta Software's own staff and contractors, and anyone in a jurisdiction we cannot lawfully pay. We may change or end the program with 30 days' notice on this page; reports received before a change are handled under the terms in force when they arrived.