Skip to content
Connect AISign inSign up free

Bug bounty program

SH

Shopify

Open on HackerOneAtlas
Platform
HackerOne
Bounties
Pays
Assets in scope
24
Disclosed reports
467
Subdomains
27,669
Vendor on CyberSIXT
Shopify (10 CVEs, 0 exploited)

Most upvoted reports467

All reports
Most upvoted reports of Shopify
ReportWeaknessDisclosedBountyVotes
Takeover an account that doesn't have a Shopify ID and moreAnalysed#867513No weakness recorded2020-09-02–3,006
Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOAnalysed#791775No weakness recorded2020-04-01–1,922
Github access token exposureAnalysed#1087489No weakness recorded2021-07-26$50,0001,601
[Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationAnalysed#796808No weakness recorded2020-04-01–894
H1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsAnalysed#422944Command and Code Injection2020-02-06–830
SSRF in Exchange leads to ROOT access in all instances#341876Server-Side Request Forgery2018-05-23–587
Email Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationAnalysed#910300Access Control2020-09-15–559
Shopify Stocky App OAuth MisconfigurationAnalysed#740989Access Control2019-12-11–527
H1514 Server Side Template Injection in Return Magic email templates?Analysed#423541Command and Code Injection2019-04-04–409
H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsAnalysed#423467Input Validation and Logic2019-11-04–372

Subdomains27,669

Root
Scope
Name suggests:Internal
First seen
Text fileClear filters33 names
Subdomains of Shopify
NameScopeFirst seen
internal.app.shopify.cominternalIn scope2026-11-14
internal.apps.shopify.cominternalIn scope2026-11-14
private.apps.shopify.cominternalIn scope2026-11-14
corp.shopify.cominternalIn scope2026-11-14
mail.corp.shopify.cominternal, mailIn scope2026-11-14
www.corp.shopify.cominternalIn scope2026-11-14
corp2.shopify.cominternalIn scope2026-11-14
corporate.shopify.cominternalIn scope2026-11-14
www.corporate.shopify.cominternalIn scope2026-11-14
cushoncovers-internal.shopify.cominternalIn scope2026-11-14
cushoncovers-staff.shopify.cominternalIn scope2026-11-14
internal.cushoncovers.shopify.cominternalIn scope2026-11-14
private.cushoncovers.shopify.cominternalIn scope2026-11-14
employee.shopify.cominternalIn scope2026-11-14
extranet.shopify.cominternalIn scope2026-11-14
www.extranet.shopify.cominternalIn scope2026-11-14
extranet2.shopify.cominternalIn scope2026-11-14
internal.help.shopify.cominternalIn scope2026-11-14
internal.shopify.cominternalIn scope2026-11-14
internal-cushoncovers.shopify.cominternalIn scope2026-11-14
smtp.internal.shopify.cominternal, mailIn scope2026-11-14
www.internal.shopify.cominternalIn scope2026-11-14
intranet.shopify.cominternalIn scope2026-11-14
www.intranet.shopify.cominternalIn scope2026-11-14
intranet1.shopify.cominternalIn scope2026-11-14
intranet2.shopify.cominternalIn scope2026-11-14
private.shopify.cominternalIn scope2026-11-14
www.private.shopify.cominternalIn scope2026-11-14
staff.shopify.cominternalIn scope2026-11-14
staff-cushoncovers.shopify.cominternalIn scope2026-11-14
www.staff.shopify.cominternalIn scope2026-11-14
presto-conductor-server-internal.presto-conductor-canada-data-presto-northamerica-northeast1-3.shopify-data-presto-canada-starscream-dataproc-w-310.shopifykloud.cominternalIn scope2026-11-14
presto-conductor-server-internal-global.presto-conductor-production-data-presto-us-central1-3.shopify-data-presto-global.shopifykloud.cominternalIn scope2026-11-14

27,651 names are covered by the program's own scope; 0 were first seen this week. Names come from ProjectDiscovery's public Chaos dataset (passive sources: certificate logs, DNS and other public data), matched to the program by its listing and its own domain scope. A name being in a dataset is not permission to test it: only what the program's own scope says is in scope, and its policy decides. CyberSIXT does not resolve, probe or scan these names. Tags come from the name alone. Source: ProjectDiscovery Chaos. Subdomains on the Atlas, or search the subdomains of every program.

A name in a dataset is not permission to test it: the program's own scope and rules decide. Data as of 2026-11-15.

CyberSIXTSignal over noise
Sign inSign up free

Updated