Reports of leaked credentials for Shopify merchant, partner, or customer accounts are evaluated on a case by case basis and actioned based on Shopify's assessment of impact.

Credentials reported must meet ALL of the following to be eligible for a reward:

• Be submitted in accordance with leaked credential submission rules & guidance
• Be valid and unknown to us
• Lead to corrective action being taken
• Include at least 100 unique leaked credentials per report

Security researchers must not split bulk credential finds into separate reports to maximize payout. Doing so may lead to report disqualification and a temporary ban from our program.

For credentials and secrets that belong to Shopify, see Leaked Shopify credentials and secrets.

Reward: $0-$500 bonus - Informative.

Reports highlighting credentials or secrets belonging to Shopify, such as employee, service, or infrastructure credentials, that are exposed publicly and not through a vulnerability in our systems are rewarded under this model.

Rewards are based on Shopify's assessment of what the credential can access, including the systems and data it reaches and the actions it allows.

Reward: $0-$10,000 - Informative or Triage, based on our assessment.

Reports of information disclosures not resulting from a vulnerability in our systems are evaluated on a case by case basis and actioned based on Shopify's assessment of impact.

Examples include accidentally exposed documents containing sensitive information.

Reward: $50 bonus - Informative - if information reported has a measurable security impact that prompts action.

Reports where a staff member or app performs actions beyond its permissions or scopes are rewarded under this model when they demonstrate one of the following:

• Escalation to one of our Sensitive Permissions (Manage Settings, Manage Payment Settings and Themes) or the equivalent app scopes.
• A direct financial impact on the store.
• Access to Buyer PII that the staff member or app isn't authorized for.

Reward: $500 bounty, Triage, for staff, collaborators, organization staff, POS staff, and Sidekick.

Reward: $500-$1,000 bounty, Triage, for apps and API clients, based on how far the access goes beyond what the app was granted.

Reward: $50 bonus, Informative, for reports that don't meet the criteria above but lead to improvements in documentation or UX.

Our permission model can be complex, and some permissions intentionally include related data. For example, staff with Orders access can see customer details on an order without Customers access. What may seem like a vulnerability is often intentional behavior.

Reports where an attacker creates an account or sign-in method with a victim's email address or phone number before the victim uses it are rewarded under this model.

Controlling a new account with none of the victim's data, or only blocking the victim's signup, is not eligible.

Reward: $500-$1,000 - Informative or Triage, based on our assessment.

Reports on the potential to impact availability of a specific store are rewarded under this model.

Reports that describe the ability to impact Availability of an entire service or component are assessed and rewarded using our standard rewards calculator, NOT this model.

Reward: $500 bounty - Triage - if the report leads to improvements in documentation or UX treatment as a result of this report.

Reports demonstrating the ability to claim a Shopify domain due to DNS misconfigurations.

Reward: $50 bonus - Informative - When our automated systems caught the issue before report submission.

Reward: $500 bounty - Resolved - if the report leads to corrective action.

Demonstrating that the domain in question is still actively receiving sensitive traffic may result in the report being rewarded at a higher level.

Reports detailing a security issue in a 3rd party system that Shopify uses, but does not own and is not fully within our control.

Reward: $100 bounty - Triage & Resolved - For low to medium severity security issues for which Shopify is able to make a change to mitigate the finding.

Reward: $500 bounty - Triage & Resolved - For high to critical severity security issues for which Shopify is able to make a change to mitigate the finding.

Additional rewards determined at the discretion of our bug bounty award panel. This may be awarded for well written, clear, and concise reports.

We may award a bonus for reports that result in action, but do not have any security implications.

Special limited-time bonuses (stay tuned!)