Shopify · disclosed reports
Information Disclosure
43 disclosed reports · $21,102 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Shopify on HackerOne- reports
- 43
- paid a bounty
- 19
Every one of the 43 is a mark on the map. Named now: 1 to 26, most upvoted first.
- [Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users image
- Blog posts atom feed of a store with password protection can be accessed by anyone
- CircleCI token in github repo allows for access to sensitive build information
- Shopify GitHub Login and Password exposed all private source code might be available.
- Disclose customer orders details by shopify chat application.
- Using GraphQL, STAFF with NO explicit permissions on Store can retrieve Shopify Payments Balance.
- H1514 [beerify.shopifycloud.com] GraphQL discloses internal beer consumption
- [h1-2102] [Yaworski's Broskis] Low privilege user can read POS PINs via graphql and elevate his privilege
- Disclosure of Github Issues
- User sensitive information disclosure
- [h1-2102] shopApps query from the graphql at /users/api returns all existing created apps, including private ones
- Production Key and Data Found on Subdomain No Longer Operated by Shopify / Dangling DNS
- Ability to see password protected content by bypassing the password page of shopify preview URL for new development stores (as of August 17, 2020)
- Fetching external resources through svg images
- H1514 Deanonymizing Exchange Marketplace private listings
- Potentially Sensitive Information on GitHub
- GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior)
- Sidekiq dashboard exposed at notary.shopifycloud.com
- None permission staff member can identify installed application and products attached to it
- Stealing users' facebook access tokens - kitcrm.com
- Staff with no permissions can listen to Shopify Ping conversations by registering to its different WebSocket Events
- H1514 Extract information about other sites (new sites) through Affiliate/Referral pages
- Apache Flink Dashboard exposure at https://streaming-sales-model-production.flink.shopifykloud.com
- [h1-2102] Information disclosure - ShopifyPlus add user displays existing Shopify ID fullname
- PII disclosure -- Past team members & their email ID(personal email) can be viewed by Staff member with no permissions on Partner Dashboard
- Publicly Accessible Datadog link
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.