Bug bounty reports15,219
Publicly disclosed HackerOne reports, with the platform's own outcome and severity.
| Report | Status | Weakness | Severity | Disclosed | Bounty | Votes |
|---|---|---|---|---|---|---|
| [out-of-scope] toxiproxy: Lack of CSRF protection allows an attacker to gain access to internal Shopify network#236349 | Valid | Server-Side Request Forgery | Medium | 2018-07-11 | – | 8 |
| Potential SSRF and disclosure of sensitive site on *shopifycloud.com#382612 | Valid | Server-Side Request Forgery | Low | 2018-07-19 | – | 9 |
| Open redirection in OAuth#405697 | Valid | Open Redirect | Low | 2018-09-24 | – | 12 |
| From full-access account to Account Owner#99863 | Valid | Access Control | – | 2018-09-18 | $500 | 13 |
| Stored XSS in partners dashboardAnalysed#271765 | Valid | Cross-site Scripting | Low | 2018-04-18 | – | 14 |
| Order notifications being sent for a deactivated staff accountAnalysed#331223 | Valid | Access Control | Low | 2018-04-12 | $500 | 16 |
| Publicly Accessible Datadog linkAnalysed#345152 | Valid | Information Disclosure | None | 2018-06-15 | – | 18 |
| Improper access check by Kit leads to controlling attributes of store & getting analytics by deleted Store member via dual messenger A/CAnalysed#351519 | Valid | Access Control | Low | 2018-06-15 | $500 | 18 |
| PII disclosure -- Past team members & their email ID(personal email) can be viewed by Staff member with no permissions on Partner DashboardAnalysed#415622 | Valid | Information Disclosure | Low | 2018-11-08 | $500 | 18 |
| Read access to hidden orders,products,customers etc. by limited access Staff member through reference page in Comments (Information disclosure )Analysed#154405 | Valid | Authentication | – | 2018-12-06 | – | 19 |
| Access to Private Photos of Apps in App section(IDOR)Analysed#318751 | Valid | Insecure Direct Object Reference | Medium | 2018-03-05 | – | 20 |
| Admin bar: Incomplete message origin validation results in XSSAnalysed#387544 | Valid | Cross-site Scripting | Medium | 2018-11-07 | – | 23 |
| [ux.shopify.com] Subdomain takeoverAnalysed#221631 | Valid | Access Control | Medium | 2018-10-19 | – | 26 |
| Preview bar: Incomplete message origin validation results in XSSAnalysed#381192 | Valid | Cross-site Scripting | Medium | 2018-07-26 | – | 26 |
| subdomain Takeover at blog.exchangemarketplace.comAnalysed#416474 | Valid | No weakness recorded | Low | 2018-10-01 | – | 27 |
| XSS on "widgets.shopifyapps.com" via "stripping" attribute and "shop" parameterAnalysed#246794 | Valid | Cross-site Scripting | None | 2018-04-03 | $1,000 | 32 |
| Bypass Filter and get Stored XssAnalysed#299424 | Valid | Cross-site Scripting | High | 2018-12-12 | $3,000 | 34 |
| XSS *.myshopify.com/collections/vendors?q=Analysed#324136 | Valid | Cross-site Scripting | Medium | 2018-04-08 | – | 35 |
| Race condition at create new LocationAnalysed#413759 | Valid | Input Validation and Logic | Low | 2018-10-05 | $500 | 36 |
| Replace other user files in Inbox messagesAnalysed#322661 | Valid | Insecure Direct Object Reference | Medium | 2018-05-01 | – | 38 |
| Potential to abuse pricing errors in saved cartsAnalysed#336131 | Valid | Input Validation and Logic | Medium | 2018-05-02 | – | 39 |
| App messaging can be hijacked by third-party websitesAnalysed#387279 | Valid | Misconfiguration and Insecure Design | Medium | 2018-11-07 | – | 39 |
| Stored XSS on buy buttonAnalysed#397088 | Valid | Cross-site Scripting | Low | 2018-09-29 | $500 | 39 |
| Disclosure of Github IssuesAnalysed#425719 | Valid | Information Disclosure | Medium | 2018-11-08 | – | 41 |
| Subdomain Takeover - https://competition.shopify.com/Analysed#365853 | Valid | Access Control | Medium | 2018-06-19 | – | 45 |
| ability to install paid themes for freeAnalysed#273557 | Valid | Access Control | Medium | 2018-05-16 | – | 50 |
| Stored xssAnalysed#415484 | Valid | Cross-site Scripting | High | 2018-11-07 | $1,000 | 52 |
| Stored XSS on activityAnalysed#391390 | Valid | Cross-site Scripting | High | 2018-08-14 | $2,000 | 55 |
| Reflected XSS on $Any$.myshopify.com/adminAnalysed#422707 | Valid | Cross-site Scripting | High | 2018-11-13 | $1,500 | 58 |
| Unauthenticated access to Zendesk tickets through athena-flex-production.shopifycloud.com Okta bypassAnalysed#397130 | Valid | Authentication | Critical | 2018-09-19 | – | 61 |
| myshopify.com domain takeoverAnalysed#320355 | Valid | Input Validation and Logic | Medium | 2018-02-27 | – | 71 |
| Ability to bypass partner email confirmation to take over any store given an employee emailAnalysed#300305 | Valid | Race Conditions | Critical | 2018-02-07 | $15,250 | 273 |
| SSRF in Exchange leads to ROOT access in all instances#341876 | Valid | Server-Side Request Forgery | Medium | 2018-05-23 | – | 587 |
Status and severity are HackerOne's. “Access stated” is what the title says; “Access needed” and techniques come from CyberSIXT's analysis of the public report, where there is one, which can be wrong. Data as of 2026-11-15.