PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shopify Thanks Over 300 Hackers, Pays $850,000+ to Hackers in Three Years

hackerone.com | vulnerability | #bug-bounty | #case-study | #hackerone | #shopify | #milestone | #ecommerce
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Shopify marks three years of its bug bounty program: $850,000+ paid to over 300 hackers, 759 vulnerabilities resolved, and a 3-hour average first response time.
Published
Collected

Related coverage

blog · hackerone.com
Common Ecommerce Vulnerabilities: Reflected XSS
Reflected XSS accounts for 10% of ecommerce bugs on HackerOne. Using a real Shopify affiliate-program bug, it shows how RXSS enables customer account breaches, PII theft, and fraudulent transactions.
blog · hackerone.com
Shopify Celebrates 5 Years on HackerOne
Shopify marks five years on HackerOne with over $1 million in bounties, 1,150+ vulnerabilities resolved, and 450+ public disclosures, crediting transparency and a seven-day bounty payout target.
blog · hackerone.com
Shopify Shares How Hackers Help to Secure $40B+ in Transactions
Shopify's risk director Andrew Dunbar explains how the bug bounty program protects 500,000+ merchants and $40B+ in sales: start private, define scope, and brace for a report surge when going public.
blog · hackenproof.com
Inside American Express India's Cloud Storage Exposure
An open MongoDB exposed 3M American Express India records, including Aadhaar and PAN numbers. What happened, and does Amex run a bug bounty today?
vulnerability · hackerone.com
How a Privilege Escalation Led to Unrestricted Admin Account Creation in Shopify
A HackerOne write-up details a Shopify privilege escalation bug enabling unrestricted admin account creation, and how layered access controls can be bypassed.
vulnerability · hackerone.com
$20M in Bounties Paid and $100M In Sight
HackerOne crosses $20 million in bounties paid to a 100,000-hacker community, with 50,000+ vulnerabilities fixed; it credits DoD's Hack the Pentagon as far cheaper than a traditional audit.
Back