Shopify · disclosed reports
Server-Side Request Forgery
8 disclosed reports · $2,000 paid
Every dot is a report; the named ones are the most upvoted. Bright dots were paid a bounty. Reports open on HackerOne.
Open Shopify on HackerOne- reports
- 8
- paid a bounty
- 3
Every one of the 8 is a mark on the map. Named now: 1 to 8, most upvoted first.
- SSRF in Exchange leads to ROOT access in all instances
- Reverse Proxy misroute leading to steal X-Shopify-Access-Token header
- SVG Server Side Request Forgery (SSRF)
- SSRF in hatchful.shopify.com
- Bypassing HTML filter in "Packing Slip Template" Lead to SSRF to Internal Kubernetes Endpoints
- Screenshot Service leaks X-ABS-App-Token
- Potential SSRF and disclosure of sensitive site on *shopifycloud.com
- [out-of-scope] toxiproxy: Lack of CSRF protection allows an attacker to gain access to internal Shopify network
paid a bounty
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-14. CVE List through 2026-11-14 · EPSS of 2026-11-13 · CISA KEV checked 2026-11-14. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.