Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Exposed Cortex API at https://cortex-ingest.shopifycloud.com/Analysed#1258871 | Valid | Misconfiguration and Insecure Design | Medium | 2022-12-02 | $6,300 | 101 |
| Ability to verify any email address you don't own - accounts.shopify.comAnalysed#229619 | Valid | Misconfiguration and Insecure Design | – | 2019-11-08 | – | 76 |
| XSS Stored via Upload avatar PNG [HTML] File in accounts.shopify.comAnalysed#964550 | Valid | Misconfiguration and Insecure Design | Low | 2020-08-30 | – | 58 |
| Shopify.com Web Cache Deception vulnerability leads to personal information and CSRF tokens leakageAnalysed#1271944 | Valid | Misconfiguration and Insecure Design | Low | 2021-10-21 | $800 | 48 |
| App messaging can be hijacked by third-party websitesAnalysed#387279 | Valid | Misconfiguration and Insecure Design | Medium | 2018-11-07 | – | 39 |
| Clickjacking in [exchangemarketplace.com]#658217 | Valid | Misconfiguration and Insecure Design | Low | 2019-09-18 | – | 17 |
| race condition in adding team members#176127 | Valid | Misconfiguration and Insecure Design | Low | 2016-11-10 | – | 16 |
| Password reset token leak via "Host header" on third party website#1092831 | Valid | Misconfiguration and Insecure Design | – | 2022-02-10 | – | 11 |
| SSRF via 'Add Image from URL' feature#67377 | Valid | Misconfiguration and Insecure Design | – | 2015-07-15 | – | 10 |
| Subdomain Takeover of multiple *.ttcdn.co domains#915649 | Valid | Misconfiguration and Insecure Design | Low | 2020-07-14 | – | 9 |
| SSL cookie without secure flag set#58679 | Valid | Misconfiguration and Insecure Design | – | 2015-07-13 | – | 9 |
| Content Spoofing#58630 | Valid | Misconfiguration and Insecure Design | – | 2015-05-05 | – | 9 |
| SSRF via 'Insert Image' feature of Products/Collections/Frontpage#67389 | Valid | Misconfiguration and Insecure Design | – | 2015-08-24 | – | 6 |
| Header Misconfiguration - PHP API#64941 | Valid | Misconfiguration and Insecure Design | – | 2015-06-11 | – | 4 |
| CSRF token fixation in facebook store app that can lead to adding attacker to victim acc#55911 | Valid | Misconfiguration and Insecure Design | – | 2015-06-25 | $500 | 4 |
| Passwords Returned in Later Responses.#90862 | Valid | Misconfiguration and Insecure Design | – | 2015-09-30 | – | 3 |
| Multiple issues on Checkout Process#56800 | Informative | Misconfiguration and Insecure Design | None | 2015-05-21 | – | 3 |
| Cookie securing your "Opening soon" store is not secured against XSS#100956 | Valid | Misconfiguration and Insecure Design | – | 2015-12-01 | – | 2 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,935 analysed so far), which can be wrong. Data as of 2026-11-15.