Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| Redirect url after login is not validated#153652 | Valid | Open Redirect | – | 2016-07-28 | – | 2 |
| Open Redirect after login at http://ecommerce.shopify.com#55546 | Valid | Open Redirect | – | 2015-10-05 | $500 | 6 |
| Open Redirect possible in https://www.shopify.com/admin/#161991 | Valid | Open Redirect | – | 2016-08-31 | – | 6 |
| Redirect in adding advance cash on delivery app#188266 | Valid | Open Redirect | Low | 2017-06-27 | – | 7 |
| Open Redirect in shopify app URL#226408 | Valid | Open Redirect | Low | 2017-07-21 | – | 8 |
| [ecommerce.shopify.com] Invalidated redirection#175168 | Valid | Open Redirect | Low | 2016-12-04 | – | 9 |
| (BYPASS) Open Redirect after login at http://ecommerce.shopify.com#155222 | Valid | Open Redirect | – | 2016-09-01 | – | 12 |
| Open redirection in OAuth#405697 | Valid | Open Redirect | Low | 2018-09-24 | – | 12 |
| Open Redirect in www.shopify.dev Environment#842035 | Valid | Open Redirect | Medium | 2021-11-18 | – | 12 |
| [apps.shopify.com] Open Redirect#160047 | Valid | Open Redirect | – | 2016-09-26 | $500 | 13 |
| Open redirection in OAuth#55525 | Valid | Open Redirect | – | 2015-07-03 | $500 | 14 |
| Open redirect using checkout_url#159522 | Valid | Open Redirect | – | 2016-09-01 | – | 17 |
| Open Redirect - www.shopify.com#905737 | Valid | Open Redirect | Low | 2020-07-14 | – | 17 |
| Open Redirect on Login Page of Stocky App#1087189 | Valid | Open Redirect | Medium | 2021-02-11 | – | 17 |
| Open redirect allows changing iframe content in *.myshopify.com/admin/themes/<id>/editor#165046 | Valid | Open Redirect | – | 2016-09-22 | – | 19 |
| https://windsor.shopify.com/ takeoverAnalysed#150374 | Valid | Open Redirect | – | 2016-07-18 | – | 20 |
| Open redirect in bulk editAnalysed#169759 | Valid | Open Redirect | – | 2016-12-04 | – | 28 |
| Open Redirect at *.myshopify.com/account/login?checkout_url=Analysed#103772 | Valid | Open Redirect | – | 2015-12-16 | – | 30 |
| Open redirect using theme installAnalysed#101962 | Valid | Open Redirect | – | 2015-12-14 | – | 61 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report (4,365 analysed so far), which can be wrong. Data as of 2026-11-15.