Clarifications to the Shopify Bug Bounty Program

It's been a big year for our bug bounty program, and we're receiving more reports than ever. AI agents have changed how a lot of you test, and we're glad to see it. It's a great time to put those tools to work helping keep Shopify and our merchants secure.

Your reports have also raised great questions. Some of the ones we hear most often are about how we assess a handful of report types. To make those answers easier to find, we're writing them out in more detail on shopify.com/bugbounty this week. Here's a summary.

Permissions, including app and API scopes

Our Permissions precedent covers staff members, apps, API clients, and Sidekick acting beyond the permissions or scopes they've been granted. What matters is what the bypass reaches: one of our Sensitive Permissions or an equivalent app scope, a direct financial impact on the store, or buyer PII the actor isn't authorized for. You can find examples of what qualifies in our criteria. Rewards range from $500 to $1,000.

Some permissions intentionally include related data. For example, staff with Orders access can see the customer details on an order by design. Check what a permission is meant to include before you report it as a bypass.

Pre-account hijacking

Pre-account hijacking is when an attacker creates an account or sign-in method with a victim's email address or phone number before the victim uses it. These reports are rewarded at $500 to $1,000 under our Pre-account hijacking precedent, based on our assessment. Controlling a new account that holds none of the victim's data, or only blocking the victim from signing up, isn't eligible.

Leaked credentials and tokens

We assess leaked credentials under two models, depending on whose credential it is.

  • Leaked account credentials ($0 to $500) covers Shopify merchant, partner, and customer accounts. Reports must follow our leaked credential rules and include at least 100 valid, unknown credentials. Splitting one bulk find across several reports may lead to report disqualification and a temporary ban from our program.

  • Leaked Shopify credentials and secrets ($0 to $10,000) cover credentials and secrets that belong to Shopify, such as employee, service, or infrastructure credentials, that are exposed publicly and not through a vulnerability in our systems. The reward depends on what the credential can access.

Ineligible issues

  • HTML injection isn't eligible unless it's chained with another vulnerability to show impact. 

  • Bypassing B2B customer restrictions, and accepting an invite with a different email than the one it was sent to, are also ineligible. 

  • GraphQL alias and directive overloading is eligible only when it meets our Denial of Service criteria. 

Scope

  • Our scope table lists shop.com, help.shop.app, Shop Minis, Sidekick, and *.shopifysvc.com.

  • Permission issues in Sidekick are rewarded under Permissions.

  • We have also removed domains that are no longer used.

The full text will be on https://www.shopify.com/bugbounty/criteria. If there are any questions or clarifications you would like, please email [email protected].