PPhying中文
Curated security research, vulnerabilities, advisories and tools for practitioners.

Shopify Shares How Hackers Help to Secure $40B+ in Transactions

hackerone.com | blog | #bug-bounty | #interview | #program-management | #shopify | #ecommerce
📄 Raw .md⬇️ Download .md🔗 Original ↗

Summary

Shopify's risk director Andrew Dunbar explains how the bug bounty program protects 500,000+ merchants and $40B+ in sales: start private, define scope, and brace for a report surge when going public.
Published
Collected

Related coverage

blog · hackerone.com
Common Ecommerce Vulnerabilities: Reflected XSS
Reflected XSS accounts for 10% of ecommerce bugs on HackerOne. Using a real Shopify affiliate-program bug, it shows how RXSS enables customer account breaches, PII theft, and fraudulent transactions.
vulnerability · hackerone.com
Shopify Thanks Over 300 Hackers, Pays $850,000+ to Hackers in Three Years
Shopify marks three years of its bug bounty program: $850,000+ paid to over 300 hackers, 759 vulnerabilities resolved, and a 3-hour average first response time.
vulnerability · yeswehack.com
How we help our clients step-by-step in their Bug Bounty journey
Interview with YesWeHack's Head of Customer Success on guiding clients through their bug bounty journey: scoping and launching programs, keeping them attractive to researchers, managing relationships.
blog · hackerone.com
How Shopify Responded When the AI Attack Surface Outpaced Security
Shopify's bug bounty team of under ten analysts faced hundreds of weekly AI-era reports; agentic AI now does first-pass triage, distilling verbose submissions and cutting onboarding time.
blog · hackerone.com
3 Bug Bounty Lessons From Retail & eCommerce Customers
HackerOne shares lessons from retail and eCommerce customers—where reflected XSS exceeds the all-industry average—and how diverse hacker skillsets and actionable insights speed up fixes.
blog · hackerone.com
A Security Engineer and Hacker Share Their Experiences with Security Assessments
Shopify's Leanne Shapton and hacker Joel Noguera describe pairing Burp Suite automation with manual testing across thousands of web apps: automation plus human expertise finds what scanners miss.
Back