Bug bounty reports15,219

Publicly disclosed HackerOne reports, with the platform's own outcome and severity.

Disclosed bug bounty reports
Report	Status	Weakness	Severity	Disclosed	Bounty	Votes
Lack of SSL Pinning on POS Application ( iOS )#55644	Informative	Cryptography	None	2015-05-21	–	3
Multiple issues on Checkout Process#56800	Informative	Misconfiguration and Insecure Design	None	2015-05-21	–	3
The POS Firmware is leaking the root Password which can be used for unauthorized access to the device.#92633	Informative	No weakness recorded	None	2015-10-09	–	3
XSS - URL Redirects#56662	Informative	Cross-site Scripting	None	2015-05-16	–	4
Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference template#3697491	Informative	Cryptography	None	2026-06-01	–	18
GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior)#2886723	Informative	Information Disclosure	None	2025-09-17	–	28
mruby-engine: UAF in MRubyEngine#initialize enables local RCE#3679660	Informative	No weakness recorded	None	2026-04-24	–	35
Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)#3161827	Informative	Authentication	None	2025-09-04	–	63
Exposure of shopify employee summit page allows anonymous user to place orders for free books#2552027	Informative	Input Validation and Logic	None	2024-07-29	–	76
admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removed#3628961	Informative	No weakness recorded	None	2026-07-03	–	78

Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.