PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

How Shopify Responded When the AI Attack Surface Outpaced Security

hackerone.com | blog | #ai-security | #bug-bounty | #agentic-ai | #case-study | #triage | #shopify | #analyst-onboarding | #ai-attack-surface
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Shopify's bug bounty team of under ten analysts faced hundreds of weekly AI-era reports; agentic AI now does first-pass triage, distilling verbose submissions and cutting onboarding time.
Published
Collected

Related coverage

blog · bugcrowd.com
The hidden cost of agentic pentesting
Bugcrowd finds agentic pentesting tools submit overwhelmingly low-signal reports on public bug bounty programs, while top findings still come from skilled humans; triage absorbs the hidden cost.
blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
blog · hackerone.com
Measuring The Fix: How We Evaluate Frontier Models on Remediation Quality
HackerOne tested frontier models on security fix quality and found the judge mattered more than the model. See how CTEM remediation earns engineer trust.
blog · hackerone.com
Common Ecommerce Vulnerabilities: Reflected XSS
Reflected XSS accounts for 10% of ecommerce bugs on HackerOne. Using a real Shopify affiliate-program bug, it shows how RXSS enables customer account breaches, PII theft, and fraudulent transactions.
blog · hackerone.com
A Security Engineer and Hacker Share Their Experiences with Security Assessments
Shopify's Leanne Shapton and hacker Joel Noguera describe pairing Burp Suite automation with manual testing across thousands of web apps: automation plus human expertise finds what scanners miss.
blog · hackerone.com
Commerce Giant Shopify Kicks Off 2021 with HackerOne (Virtual) Live Hacking Event: h1-2102
Shopify hosted its third HackerOne live hacking event h1-2102, a 10-day virtual challenge with over 30 hackers from seven countries, giving researchers access to closed, high-impact systems.
Back