Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| H1514 CSRF in Domain transfer allows adding your domain to other user's accountAnalysed#416978 | Valid | Cross-Site Request Forgery | High | 2020-03-30 | – | 23 |
| xss triggered in "myshopify.com/admin/product"Analysed#978125 | Valid | No weakness recorded | High | 2020-09-15 | – | 25 |
| XSS in $shop$.myshopify.com/admin/ via "Button Objects" in malicious appAnalysed#217745 | Valid | Cross-site Scripting | High | 2017-05-22 | $800 | 30 |
| XSS in $shop$.myshopify.com/admin/ via twine template injection in "Shopify.API.Modal.input" method when using a malicious appAnalysed#217790 | Valid | Cross-site Scripting | High | 2017-06-01 | $1,000 | 31 |
| Bypass Filter and get Stored XssAnalysed#299424 | Valid | Cross-site Scripting | High | 2018-12-12 | $3,000 | 34 |
| Blind Stored XSS Via Staff NameAnalysed#948929 | Valid | Cross-site Scripting | High | 2020-08-18 | $3,000 | 45 |
| Stored xssAnalysed#415484 | Valid | Cross-site Scripting | High | 2018-11-07 | $1,000 | 52 |
| Stored XSS on activityAnalysed#391390 | Valid | Cross-site Scripting | High | 2018-08-14 | $2,000 | 55 |
| Reflected XSS on $Any$.myshopify.com/adminAnalysed#422707 | Valid | Cross-site Scripting | High | 2018-11-13 | $1,500 | 58 |
| Reflective Cross-site Scripting via Newsletter FormAnalysed#709336 | Valid | Cross-site Scripting | High | 2019-10-11 | $2,000 | 79 |
| XSS on $shop$.myshopify.com/admin/ and partners.shopify.com via whitelist bypass in SVG icon for sales channel applicationsAnalysed#232174 | Valid | Cross-site Scripting | High | 2017-06-27 | $5,000 | 88 |
| H1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie StuffingAnalysed#422043 | Valid | Cross-site Scripting | High | 2019-04-17 | – | 195 |
| Stored XSS in my staff name fired in another your internal panelAnalysed#946053 | Valid | Cross-site Scripting | High | 2020-07-29 | – | 326 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.