Bug bounty program · HackerOne
Most upvoted reports467
- #867513ValidAnalysedTakeover an account that doesn't have a Shopify ID and moreShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Business logic flaw–3,006votes
- #791775ValidAnalysedEmail Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Authentication bypass–1,922votes
- #1087489ValidAnalysedGithub access token exposureShopify · No weakness recorded · 2021 · needs: no account · Leaked secret or key, Information disclosure$50,0001,601votes
- #796808ValidAnalysed[Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain–894votes
- #422944ValidAnalysedH1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsShopify · Command and Code Injection · 2020 · needs: a user account · Unsafe file upload, OS command injection, SSRF–830votes
- #341876ValidSSRF in Exchange leads to ROOT access in all instancesShopify · Server-Side Request Forgery · 2018–587votes
- #910300ValidAnalysedEmail Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationShopify · Access Control · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Authentication bypass–559votes
- #740989ValidAnalysedShopify Stocky App OAuth MisconfigurationShopify · Access Control · 2019 · needs: a user account · Authentication bypass, Privilege escalation–527votes
- #423541ValidAnalysedH1514 Server Side Template Injection in Return Magic email templates?Shopify · Command and Code Injection · 2019 · needs: a user account · Template injection–409votes
- #423467ValidAnalysedH1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsShopify · Input Validation and Logic · 2019 · needs: a user account · Weak cryptography, Business logic flaw, Information disclosure–372votes
Subdomains27,669
27,651 covered by the program's own scope · 0 first seen this week
Roots:shopify.com 26,370 · 26,356 in scopeshopifykloud.com 1,295 · 1,295 in scopeexchangemarketplace.com 4
Name suggestsAnything
27,669 names
| Name | Scope | First seen |
|---|---|---|
| blog.exchangemarketplace.com | Not in the scope | 2026-11-14 |
| email.exchangemarketplace.com | Not in the scope | 2026-11-14 |
| help.exchangemarketplace.com | Not in the scope | 2026-11-14 |
| www.exchangemarketplace.com | Not in the scope | 2026-11-14 |
| 0.shopify.com | In scope | 2026-11-14 |
| 000.shopify.com | In scope | 2026-11-14 |
| 007.shopify.com | In scope | 2026-11-14 |
| 00counts.shopify.com | In scope | 2026-11-14 |
| kikokiko.00www.shopify.com | In scope | 2026-11-14 |
| 01.shopify.com | In scope | 2026-11-14 |
| 01counts.shopify.com | In scope | 2026-11-14 |
| 02.shopify.com | In scope | 2026-11-14 |
| 02counts.shopify.com | In scope | 2026-11-14 |
| 03.shopify.com | In scope | 2026-11-14 |
| 03counts.shopify.com | In scope | 2026-11-14 |
| 04counts.shopify.com | In scope | 2026-11-14 |
| 05counts.shopify.com | In scope | 2026-11-14 |
| 06w.shopify.com | In scope | 2026-11-14 |
| 07counts.shopify.com | In scope | 2026-11-14 |
| 080.shopify.com | In scope | 2026-11-14 |
| mail.080.shopify.commail | In scope | 2026-11-14 |
| 080d3d.shopify.com | In scope | 2026-11-14 |
| 0876425209hatchful.shopify.com | In scope | 2026-11-14 |
| 09counts.shopify.com | In scope | 2026-11-14 |
| 0b841ea2bd1a85c0.shopify.com | In scope | 2026-11-14 |
| 0cdn.shopify.com | In scope | 2026-11-14 |
| 1.shopify.com | In scope | 2026-11-14 |
| 1-cushoncovers.shopify.com | In scope | 2026-11-14 |
| cushoncovers.1.shopify.com | In scope | 2026-11-14 |
| www.1.shopify.com | In scope | 2026-11-14 |
| 10.shopify.com | In scope | 2026-11-14 |
| www.10.shopify.com | In scope | 2026-11-14 |
| 100.shopify.com | In scope | 2026-11-14 |
| 1000.shopify.com | In scope | 2026-11-14 |
| 1000skis.shopify.com | In scope | 2026-11-14 |
| 101.shopify.com | In scope | 2026-11-14 |
| 103.shopify.com | In scope | 2026-11-14 |
| 105.shopify.com | In scope | 2026-11-14 |
| 106.shopify.com | In scope | 2026-11-14 |
| 107.shopify.com | In scope | 2026-11-14 |
| 108.shopify.com | In scope | 2026-11-14 |
| 109.shopify.com | In scope | 2026-11-14 |
| 11.shopify.com | In scope | 2026-11-14 |
| cushoncovers.11.shopify.com | In scope | 2026-11-14 |
| www.11.shopify.com | In scope | 2026-11-14 |
| 110.shopify.com | In scope | 2026-11-14 |
| 11091521400593.shopify.com | In scope | 2026-11-14 |
| 111.shopify.com | In scope | 2026-11-14 |
| 1111.shopify.com | In scope | 2026-11-14 |
| 11192521403954.shopify.com | In scope | 2026-11-14 |
| 11192521404255.shopify.com | In scope | 2026-11-14 |
| 112.shopify.com | In scope | 2026-11-14 |
| 11211d-e0.shopify.com | In scope | 2026-11-14 |
| 11285521401250.shopify.com | In scope | 2026-11-14 |
| 11290521402560.shopify.com | In scope | 2026-11-14 |
| 114.shopify.com | In scope | 2026-11-14 |
| 115.shopify.com | In scope | 2026-11-14 |
| 116.shopify.com | In scope | 2026-11-14 |
| 117.shopify.com | In scope | 2026-11-14 |
| 118.shopify.com | In scope | 2026-11-14 |
| 119.shopify.com | In scope | 2026-11-14 |
| 11counts.shopify.com | In scope | 2026-11-14 |
| 12.shopify.com | In scope | 2026-11-14 |
| 12-cushoncovers.shopify.com | In scope | 2026-11-14 |
| cushoncovers.12.shopify.com | In scope | 2026-11-14 |
| www.12.shopify.com | In scope | 2026-11-14 |
| 120.shopify.com | In scope | 2026-11-14 |
| 121.shopify.com | In scope | 2026-11-14 |
| 123.shopify.com | In scope | 2026-11-14 |
| www.123.shopify.com | In scope | 2026-11-14 |
| 1234.shopify.com | In scope | 2026-11-14 |
| 12345.shopify.com | In scope | 2026-11-14 |
| 123456.shopify.com | In scope | 2026-11-14 |
| 124.shopify.com | In scope | 2026-11-14 |
| 125.shopify.com | In scope | 2026-11-14 |
| 126.shopify.com | In scope | 2026-11-14 |
| 128.shopify.com | In scope | 2026-11-14 |
| 129.shopify.com | In scope | 2026-11-14 |
| 1290sqm.shopify.com | In scope | 2026-11-14 |
| 12counts.shopify.com | In scope | 2026-11-14 |
| 12cushoncovers.shopify.com | In scope | 2026-11-14 |
| 12min.shopify.com | In scope | 2026-11-14 |
| 13.shopify.com | In scope | 2026-11-14 |
| www.13.shopify.com | In scope | 2026-11-14 |
| 130.shopify.com | In scope | 2026-11-14 |
| 131.shopify.com | In scope | 2026-11-14 |
| 132.shopify.com | In scope | 2026-11-14 |
| 133.shopify.com | In scope | 2026-11-14 |
| 134.shopify.com | In scope | 2026-11-14 |
| 137.shopify.com | In scope | 2026-11-14 |
| 139.shopify.com | In scope | 2026-11-14 |
| 13counts.shopify.com | In scope | 2026-11-14 |
| 14.shopify.com | In scope | 2026-11-14 |
| 14-cushoncovers.shopify.com | In scope | 2026-11-14 |
| www.14.shopify.com | In scope | 2026-11-14 |
| 140.shopify.com | In scope | 2026-11-14 |
| 142.shopify.com | In scope | 2026-11-14 |
| 14counts.shopify.com | In scope | 2026-11-14 |
| 15.shopify.com | In scope | 2026-11-14 |
| cushoncovers.15.shopify.com | In scope | 2026-11-14 |
Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. See the subdomains on the Atlas.
A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-14.