Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| [out-of-scope] toxiproxy: Lack of CSRF protection allows an attacker to gain access to internal Shopify network#236349 | Valid | Server-Side Request Forgery | Medium | 2018-07-11 | – | 8 |
| Potential SSRF and disclosure of sensitive site on *shopifycloud.com#382612 | Valid | Server-Side Request Forgery | Low | 2018-07-19 | – | 9 |
| Screenshot Service leaks X-ABS-App-Token#1067443 | Valid | Server-Side Request Forgery | None | 2021-02-12 | – | 14 |
| Bypassing HTML filter in "Packing Slip Template" Lead to SSRF to Internal Kubernetes EndpointsAnalysed#1115139 | Valid | Server-Side Request Forgery | Low | 2021-12-02 | – | 20 |
| SSRF in hatchful.shopify.comAnalysed#409701 | Valid | Server-Side Request Forgery | Low | 2019-04-04 | $500 | 56 |
| SVG Server Side Request Forgery (SSRF)Analysed#223203 | Valid | Server-Side Request Forgery | Low | 2017-09-22 | $500 | 81 |
| Reverse Proxy misroute leading to steal X-Shopify-Access-Token headerAnalysed#429617 | Valid | Server-Side Request Forgery | Medium | 2019-03-14 | $1,000 | 90 |
| SSRF in Exchange leads to ROOT access in all instances#341876 | Valid | Server-Side Request Forgery | Medium | 2018-05-23 | – | 587 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.