TechPrufer
Sign inGet started

Blogs›Shopify›Application Security Program Development

Application Security Program Development

Application Security Program Development

2
posts
2019–2021

This feature thread tracks the development and enhancement of Shopify's application security program. Initial efforts focused on establishing a security mindset within the company culture and growing the security team from a single individual to dozens of engineers. The program is structured around scaling secure applications, scaling security teams, and scaling security interactions. Key strategies include establishing a homogeneous technical baseline (e.g., defaulting to Ruby on Rails), gaining programmatic control over certificate issuance and renewal through partnerships with Certificate Authorities like Let's Encrypt, and automating the deployment and management of TLS certificates across millions of domains to ensure a secure and consistent experience for merchants.

2021

Let’s Encrypt x Shopify: Securing the Web 4.5 Million Domains at a Time - Shopify

6/24/2021

This post details Shopify's transition to using Let's Encrypt as its primary Certificate Authority for issuing and renewing TLS certificates for merchant domains. It highlights the challenges of programmatic certificate management with previous providers, the benefits of Let's Encrypt's ACME protocol for automation, and the successful implementation of a system capable of provisioning and renewing certificates for millions of domains within hours, significantly improving responsiveness for emergency rotations.

2019

Building Shopify’s Application Security Program - Shopify

4/26/2019

This post details the foundational elements and strategic pillars of Shopify's application security program. It outlines the approach to scaling secure applications by standardizing on a technical baseline (Ruby on Rails), improving service visibility through production engineering initiatives, and providing secure defaults for new projects. It also discusses scaling security teams by specializing roles and utilizing external validation services, and scaling security interactions through automated tripwires, code-level security checks (e.g., for `html_safe`), and infrastructure-level safeguards.