Intel · bug bounty
Disclosed bug bounty reports
Every publicly disclosed report on HackerOne the Atlas holds: HackerOne's own outcome, severity, the weakness as filed and the access the title states, and, for analysed reports, how the bug was found in our words.
SortMost upvoted
WeaknessAny class
- Any class
- Cross-site Scripting127
- Cross-Site Request Forgery16
- Open Redirect19
- Server-Side Request Forgery8
- Command and Code Injection5
- Injection and Smuggling3
- File and Path Handling1
- Memory Corruption1
- Race Conditions2
- Denial of Service4
- Input Validation and Logic11
- Misconfiguration and Insecure Design18
- Cryptography4
- Information Disclosure43
- Authentication61
- Access Control87
- Insecure Direct Object Reference8
- Other weaknesses2
- No weakness recorded47
Access (title)Any
Access (analysis)Any
TechniqueAny
- Any
- Account takeover chain5
- Authentication bypass4
- E-mail verification bypass4
- Business logic flaw3
- Information disclosure2
- Privilege escalation2
- CSRF1
- Leaked secret or key1
- Missing authorisation check1
- OS command injection1
- Reflected XSS1
- SSRF1
- Stored XSS1
- Template injection1
- Unsafe file upload1
- Weak cryptography1
467 of 15,219 reports · $281,352 in bounties · 161 analysed so far
- #867513ValidAnalysedTakeover an account that doesn't have a Shopify ID and moreShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Business logic flaw–3,006votes
- #791775ValidAnalysedEmail Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege Escalation to Any Shop Owner by Taking Advantage of the Shopify SSOShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Authentication bypass–1,922votes
- #1087489ValidAnalysedGithub access token exposureShopify · No weakness recorded · 2021 · needs: no account · Leaked secret or key, Information disclosure$50,0001,601votes
- #796808ValidAnalysed[Part II] Email Confirmation Bypass in myshop.myshopify.com that Leads to Full Privilege EscalationShopify · No weakness recorded · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain–894votes
- #422944ValidAnalysedH1514 Remote Code Execution on kitcrm using bulk customer update of Priority ProductsShopify · Command and Code Injection · 2020 · needs: a user account · Unsafe file upload, OS command injection, SSRF–830votes
- #341876ValidSSRF in Exchange leads to ROOT access in all instancesShopify · Server-Side Request Forgery · 2018–587votes
- #910300ValidAnalysedEmail Confirmation Bypass in your-store.myshopify.com which leads to privilege escalationShopify · Access Control · 2020 · needs: a user account · E-mail verification bypass, Account takeover chain, Authentication bypass–559votes
- #740989ValidAnalysedShopify Stocky App OAuth MisconfigurationShopify · Access Control · 2019 · needs: a user account · Authentication bypass, Privilege escalation–527votes
- #423541ValidAnalysedH1514 Server Side Template Injection in Return Magic email templates?Shopify · Command and Code Injection · 2019 · needs: a user account · Template injection–409votes
- #423467ValidAnalysedH1514 Ability to MiTM Shopify PoS Session to Takeover CommunicationsShopify · Input Validation and Logic · 2019 · needs: a user account · Weak cryptography, Business logic flaw, Information disclosure–372votes
- #691611ValidAnalysedXSS while logging using GoogleShopify · Cross-site Scripting · 2019 · needs: a user account · Reflected XSS$1,750341votes
- #946053ValidAnalysedStored XSS in my staff name fired in another your internal panelShopify · Cross-site Scripting · 2020 · needs: a user account · Stored XSS–326votes
- #270981ValidAnalysedShopify admin authentication bypass using partners.shopify.comShopify · Access Control · 2017 · needs: a user account · Missing authorisation check, Privilege escalation–311votes
- #796956ValidAnalysedAble to Takeover Merchants Accounts Even They Have Already Setup SSO, After Bypassing the Email ConfirmationShopify · No weakness recorded · 2020 · needs: a user account · Authentication bypass, Account takeover chain–310votes
- #807924ValidAnalysedCSRF on connecting Paypal as Payment ProviderShopify · Cross-Site Request Forgery · 2020 · needs: not clear from the report · CSRF, Business logic flaw–304votes
- #300305ValidAbility to bypass partner email confirmation to take over any store given an employee emailShopify · Race Conditions · 2018$15,250273votes
- #1695604ValidDoS Vulnerability via Cache Poisoning on cdn.shopify.com and shopify-assets.shopifycdn.comShopify · Other weaknesses · 2025 · Medium$3,800266votes
- #2885269ValidShopify Partners Invitation Process Allows Privilege Escalation Without Email VerificationShopify · Access Control · 2025 · Medium–245votes
- #1444682ValidXSS at jamfpro.shopifycloud.comShopify · Cross-site Scripting · 2023$9,400240votes
- #422043ValidH1514 DOMXSS on Embedded SDK via Shopify.API.setWindowLocation abusing cookie StuffingShopify · Cross-site Scripting · 2019–195votes
- #421859ValidH1514 [*.(my)shopify.com] - Viewing Password Protected ContentShopify · Authentication · 2019$3,000192votes
- #2207248ValidIDOR on GraphQL queries BillingDocumentDownload and BillDetailsShopify · Insecure Direct Object Reference · 2024$5,000187votes
- #1457471ValidLimited Privilege User Can Create Unauthorized Referrals on partners.shopify.comShopify · Access Control · 2025 · Medium–181votes
- #1145162ValidXSS at https://exchangemarketplace.com/blogsearchShopify · Cross-site Scripting · 2021–174votes
- #898528ValidGraphQL AdminGenerateSessionPayload is leaked to staff with no permissionShopify · No weakness recorded · 2020–173votes
- #1086108Valid[h1-2102] FQDN takeover on all Shopify wholesale customer domains by trailing dot (RFC 1034)Shopify · Access Control · 2021$3,100166votes
- #1699762ValidXSS in www.shopify.com/markets?utm_source=Shopify · Cross-site Scripting · 2022–159votes
- #981472ValidUndocumented `fileCopy` GraphQL APIShopify · Access Control · 2020$2,000157votes
- #837729ValidSession works after logout from Shopify account and password of online store is displayedShopify · No weakness recorded · 2020–157votes
- #1276742ValidStored XSS in SVG file as data: urlShopify · Cross-site Scripting · 2023$5,300153votes
- #1064869ValidInformations disclosure - Access to some checkout informationsShopify · No weakness recorded · 2021–150votes
- #273099ValidUser with removed manage shops permissions is still able to make changes to a shopShopify · Access Control · 2020–145votes
- #423136ValidH1514 Session Fixation on multiple shopify-built apps on *.shopifycloud.com and *.shopifyapps.comShopify · Authentication · 2019–144votes
- #2279572ValidHTTP Response Header Injection in shopify/pitchfork + Rack 3Shopify · Injection and Smuggling · 2025 · Low$800136votes
- #1021906Valid[Information Disclosure] Amazon S3 Bucket of Shopify Ping (iOS) have public access of other users imageShopify · Information Disclosure · 2020$2,900135votes
- #1257428ValidCreate free Shopify application credits.Shopify · Access Control · 2021–134votes
- #1754843ValidReflected XSS In Marketing Reports Page On *.myshopify.com/adminShopify · Cross-site Scripting · 2025 · Medium–128votes
- #729424Not checked yetStored XSS in private messageShopify · Cross-site Scripting$1,000124votes
- #231053ValidXSS on any Shopify shop via abuse of the HTML5 structured clone algorithm in postMessage listener on "/:id/digital_wallets/dialog"Shopify · Cross-site Scripting · 2017$3,000121votes
- #763994ValidDisclose Any Store products, Files, Purchase Orders Via Email through Shopify Stocky APPShopify · Access Control · 2020–116votes
- #1679734ValidAccount Takeover Vulnerability in Shopify Collabs Platform Due to Missing Email VerificationShopify · No weakness recorded · 2025 · Low$800112votes
- #1940245ValidReflected XSS on help.shopify.comShopify · Cross-site Scripting · 2024$500111votes
- #489284ValidAccess to Employee calendar disclosing internal presentation and meetingsShopify · Access Control · 2019$1,000111votes
- #2509022ValidReflected XSS in AI Chat Bot Greetings at help.shopify.com via Markdown Image RenderingShopify · Cross-site Scripting · 2026 · Medium$1,600110votes
- #1417288ValidAdmin panel Exposure without credential at https://plus-website.shopifycloud.com/admin.phpShopify · Access Control · 2022$2,900109votes
- #756729ValidStored XSS in Shopify ChatShopify · Cross-site Scripting · 2019$500106votes
- #470206ValidReflected XSS in *.myshopify.com/account/registerShopify · Cross-site Scripting · 2019–104votes
- #1363672ValidBypass a fix for report #708013Shopify · Authentication · 2021$3,500102votes
- #1258871ValidExposed Cortex API at https://cortex-ingest.shopifycloud.com/Shopify · Misconfiguration and Insecure Design · 2022$6,300101votes
- #1410459ValidReflected XSS online-store-git.shopifycloud.comShopify · Cross-site Scripting · 2022$3,50098votes
The status is HackerOne's own outcome. “Access (title)” is what the report's title states; “Access (analysis)” and techniques come from CyberSIXT's own analysis, a model's summary of the public report that may be wrong. Data as of 2026-11-14.