Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Unauthenticated access to details of hidden products in any shop via title emuneration#93394	Valid	Authentication	–	2015-10-23	$1,000	3
Payment gateway status transferred to Shopify without authentication#56628	Valid	Cross-Site Request Forgery	–	2016-09-27	–	7
Unauthenticated Stored XSS on <any>.myshopify.com via checkout page#189378	Valid	Cross-site Scripting	–	2016-12-16	–	14
Store Deletion or Sell without authentication#1087382	Valid	Authentication	Low	2021-10-21	–	20
Unauthenticated access to Checkout Blocks employee-only endpoints exposed merchant metadata#3954327	Valid	Authentication	Medium	2026-11-03	$3,100	33
Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permission#700831	Valid	Input Validation and Logic	Medium	2019-10-10	–	53
Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypassAnalysed#397130	Valid	Authentication	Critical	2018-09-19	–	61
Exposure of shopify employee summit page allows anonymous user to place orders for free books#2552027	Informative	Input Validation and Logic	None	2024-07-29	–	76

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (1,683 analysed so far), which can be wrong. Data as of 2026-11-15.