What we are looking for

We want to proactively discover and remediate security vulnerabilities on our digital assets

The vulnerabilities identified in the HackerOne reports will be classified by the degree of risk as well as the impact they present to the host system, this includes the amount and type of data exposed, privilege level obtained, the proportion of systems or users affected.

What is a Bug Bounty Program?

shopify’s Bug Bounty Program (BBP) is an initiative driven and managed by the shopify Information Security team.

• Security researchers are encouraged to report any behavior impacting the information security posture of shopify’ products and services. If you are performing research, please use your own accounts and do not interact with other people’s accounts or data.

• Document your findings thoroughly, providing steps to reproduce and send your report to us. Reports with complete vulnerability details, including screenshots or video, are essential for a quick response. If the report is not detailed enough to reproduce the issue, the issue will not be eligible for a reward. *Reference HackerOne guidance on writing quality reports:

  • https://docs.hackerone.com/hackers/quality-reports.html
  • https://www.hacker101.com/sessions/good_reports

• We will contact you to confirm that we’ve received your report and trace your steps to reproduce your research.

• We will work with the affected teams to validate the report.

• We will issue bounty awards for eligible findings. To be eligible for rewards, reports must comply with all parts of this policy and you must be the first to report the issue to us. You must be 18 or older to be eligible for an award.

• We will notify you of remediation and may reach out for questions or clarification. You must be available to provide additional information if needed by us to reproduce and investigate the report.

Response Targets

We will make a best effort to meet the following response targets for hackers participating in our program:

• Time to first response (from report submit) - 1 business days
• Time to triage (from report submit) - 2 business days
• Time to bounty (from triage) - 10 business days

We’ll try to keep you informed about our progress throughout the process.

Program Rules

• Do not try to further pivot into the network by using a vulnerability. The rules around Remote Code Execution (RCE), SQL Injection (SQLi), and FileUpload vulnerabilities are listed below.

• Do not try to exploit service providers we use, prohibited actions include, but are not limited to bruteforcing login credentials of Domain Registrars, DNS Hosting Companies, Email Providers and/or others. The Firm does not authorize you to perform any actions to any property/system/service/data not listed below.

• If you encounter Personally Identifiable Information (PII) contact us immediately. Do not proceed with access and immediately purge any local information, if applicable.

• Please limit any automated scanning to 60 requests per second. Aggressive testing that causes service degradation will be grounds for removal from the program.

• Submit one vulnerability per- report, unless you need to chain vulnerabilities to provide impact.

• When duplicates occur, we only award the first report that was received (provided that it can be fully reproduced).

• Multiple vulnerabilities caused by one underlying issue will be awarded one bounty.

• Social engineering (e.g. phishing, vishing, smishing) is prohibited.

• Make a good faith effort to avoid privacy violations, destruction of data, and interruption or degradation of our service. Only interact with accounts you own or with the explicit permission of the account holder.

Disclosure Policy

• As this is a private program, please do not discuss this program or any vulnerabilities (even resolved ones) outside of the program without express consent from the organization.
• Follow HackerOne's disclosure guidelines.

How To Create Accounts

• Go to our Website
• Register
• use @hackerone.com email address
• Only use accounts you're authorised to access

Rewards

Our rewards are based on severity per the Common Vulnerability Scoring Standard (CVSS). Please note these are general guidelines, and that reward decisions are up to the discretion of shopify.

#Out of scope vulnerabilities

Note: 0-day vulnerabilities may be reported 30 days after initial publication. We have a team dedicated to tracking these issues; hosts identified by this team and internally ticketed will not be eligible for bounty.

The following issues are considered out of scope:

When reporting vulnerabilities, please consider (1) attack scenario / exploitability, and (2) security impact of the bug. The following issues are considered out of scope:

• Disruption of our service (DoS, DDoS).
• PII - do not collect any personally identifiable information - including credit card information, addresses and phone numbers from other customers
• Reports from automated tools or scans
• Social engineering of employees or contractors
• For the time being we are making all vulnerabilities in Flash files out of scope
• Reports affecting outdated browsers
• Known vulnerabilities on deprecated assets not currently covered by CloudFlare.
• Missing security best practices and controls (rate-limiting/throttling, lack of CSRF protection, lack of security headers, missing flags on cookies, descriptive errors, server/technology disclosure - without clear and working exploit)
• Lack of crossdomain.xml, p3p.xml, robots.txt or any other policy files and/or wildcard presence/misconfigurations in these
• Use of a known-vulnerable libraries or frameworks - for example an outdated JQuery or AngularJS (without clear and working exploit)
• Self-exploitation (cookie reuse, self cookie-bomb, self denial-of-service etc.)
• Self Cross-site Scripting vulnerabilities without evidence on how the vulnerability can be used to attack another user
• Lack of HTTPS
• Reports about insecure SSL / TLS configuration
• Password complexityrequirements, account/email enumeration, or any report that discusses how you can learn whether a given username or email address is easy to guess
• Presence/Lack of autocomplete attribute on web forms/password managers
• Server Banner Disclosure/Technology used Disclosure
• Full Path Disclosure
• IP Address Disclosure
• CSRF on logout or insignificant functionalities
• Publicly accessible login panels
• Clickjacking
• CSS Injection attacks (Unless it gives you ability to read anti-CSRF tokens or other sensitive information)
• Tabnabbing
• Host Header Injection (Unless it givesyou access to interim proxies)
• Cache Poisoning
• Reflective File Download
• Cookie scoped to parent domain or anything related to the path misconfiguration and improperly scoped
• Private IP/Hostname disclosures or real IP disclosures for services using CDN
• Open ports which do not lead directly to a vulnerability
• Weak Certificate Hash Algorithm
• Any physical/wireless attempt against our property or data centers

Safe Harbor

This policy is designed to be compatible with common vulnerability disclosure good practice. It does not give you permission to act in any manner that is inconsistent with the law, or which might cause us to be in breach of any of its legal obligations, including but not limited to:

• The General Data Protection Regulation 2016/679 (GDPR) andthe Data Protection Act 2018

We affirm that we will not seek prosecution of any security researcher who reports any security vulnerability on a service or system, where the researcher has acted in good faith and in accordance with this disclosure policy.

shopify cannot authorize any activity on third-party products or guarantee they won’t pursue legal action against you. We aren’t responsible for your liability from actions performed on third parties.

Thank you for helping keep us and our users safe!