Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
H1514 Shopify API ruby SDK session setup lacks input validation, resulting in SSRF and leakage of client secret#423437	Valid	Input Validation and Logic	None	2019-04-05	–	11
[h1-2102] [Yaworski's Broskis] Suspected overcharge and chargebacks in PoS#1089978	Valid	Input Validation and Logic	Low	2021-12-03	–	12
Bypass GraphQL rate limit by abusing negative cost queries#481518	Valid	Input Validation and Logic	Low	2019-01-24	–	24
H1514 Simple phishing using auto-created modal with weak URL-pattern check in incontext_app_link#422279	Valid	Input Validation and Logic	Medium	2019-04-10	–	25
Race condition at create new LocationAnalysed#413759	Valid	Input Validation and Logic	Low	2018-10-05	$500	36
Potential to abuse pricing errors in saved cartsAnalysed#336131	Valid	Input Validation and Logic	Medium	2018-05-02	–	39
Unauthenticated read and write access to ALL endpoints of a store is possible for removed staff members who had "Apps" permissionAnalysed#700831	Valid	Input Validation and Logic	Medium	2019-10-10	–	53
Ability to Disable the Login Attempt of any Shopify Owner for 24 hrs (Zero_Click)Analysed#1406495	Valid	Input Validation and Logic	Low	2022-02-15	$900	65
myshopify.com domain takeoverAnalysed#320355	Valid	Input Validation and Logic	Medium	2018-02-27	–	71
Exposure of shopify employee summit page allows anonymous user to place orders for free books#2552027	Informative	Input Validation and Logic	None	2024-07-29	–	76
H1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsAnalysed#423467	Valid	Input Validation and Logic	Medium	2019-11-04	–	372

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (3,686 analysed so far), which can be wrong. Data as of 2026-11-15.