The Treasury Board Secretariat issues requirements with regard to security and accessibility for public-facing applications such as ArriveCAN. We did spend money, approximately 4% of the overall funding, on security requirements.
On November 14th, 2022. See this statement in context.