Bug Bounty Program and Security Vulnerability Management

8 posts · Feb 2017 – Jun 2022

What this trail covers

Shopify has evolved its Bug bounty program and its role in managing security vulnerabilities. Initial efforts focused on establishing a security response program and evolving it into a bug bounty with HackerOne. The program emphasizes high minimum payouts, transparency in disclosure, and educational opportunities for researchers. It has led to numerous fixes and significant bounty payouts. This post details the program reaching the $1M USD milestone in 2018 and doubling the maximum bounty to $10,000 for critical vulnerabilities, and highlights the 'Invoice Swap', 'Sneaky Catfish', and 'Remote Code Execution' vulnerabilities as examples of the program's impact.

All Shopify trails

Jun 2022Making Open Source Safer for Everyone with Shopify’s Bug Bounty Program - ShopifyThis post details a specific contribution to the Rails library inspired by a bug bounty report. The report demonstrated a deserialization vulnerability in `ActiveSupport::MessageEncryptor` due to its default use of the unsafe `Marshal` serializer. Shopify's contribution involved patching their internal applications to use JSON serialization and then contributing upstream to change the default serializer in Rails versions 7.1.X and above for both `MessageEncryptor` and `MessageVerifier`. Additionally, Shopify developed a patch to hook `Marshal.load` and `Marshal.dump` to track and deprecate its use in production environments, encouraging safer serialization practices.
Mar 2022Shopify’s Bug Bounty Program Raises Maximum Payout in 2022 - ShopifyThis post details the evolution of Shopify's bug bounty program by doubling the maximum bounty payout to $100,000 for CVSS 10.0 issues and increasing payouts for High and Critical severity bugs. It also designates Shopify Plus, arrive-server.shopifycloud.com, and shop.app as core assets, meaning critical bugs in these services will be paid according to the new scale. The post also highlights the program's success in 2021, paying out over $1 million in bounties, and the first full year of CVSS-based bounties, leading to more consistent decisions and productive discussions. Additionally, it announces the creation of a "Bug Bounty Resources" GitHub repository with guides and a CVSS scoring guide, and reiterates Shopify's commitment to supporting open-source security through sponsorships.
Mar 2021Updates on Shopify's Bug Bounty Program 2021 - ShopifyThis post details the evolution of Shopify's Bug Bounty program in 2020 and early 2021. Key contributions include: increased maximum bounty to $50,000, leading to critical vulnerability reports in Shopify ID; awarding over $2 million in total bounties and over $460,000 in 2020; successful implementation of CVSS for bounty calculation, increasing transparency and objectivity; release of a GraphQL Hacking Guide to reduce barriers for researchers; creation of a dedicated bug bounty team to improve response times and reduce duplicates; development of tooling to surface reports requiring follow-up; and the upcoming relaunch of the Shopify Experiments private program with a revised focus on special apps and features.
Feb 2020Bug Bounty Year in Review 2019 - ShopifyThis post details improvements to Shopify's bug bounty program in 2019, including paying bounties in full within 7 days, increasing the maximum bounty to $50,000 for specific vulnerability types, and improving duplicate report handling. It also discusses leveraging provisioned accounts for analytics, experimenting with a private bug bounty program (Shopify-Experiments), and automating response times with Slack bots and shorthand commands. The post highlights reduced average response and triage times, faster bounty payouts, and an increase in disclosed bugs.
Apr 2019One Million Dollars in Bug Bounties - ShopifyThis post announces that Shopify's bug bounty program has awarded over $1M USD in bounties, making it the fifth public program on HackerOne to reach this milestone. It provides statistics on the program's success (over 950 bugs resolved, 750+ bounties awarded, 375+ public disclosures) and highlights three interesting resolved bugs: an SSRF leading to ROOT access, an admin authentication bypass, and a stored XSS vulnerability. It also mentions plans to experiment with new ways to drive hacker engagement and make the program more lucrative.
Advertisement
Dec 2018Bug Bounty Year in Review 2018 - ShopifyThis post details the 2018 year-in-review for Shopify's Bug Bounty program. Key contributions include: reducing average time to triage to 10 hours, hosting the H1-514 live hacking event in Montreal which yielded over 50 valid vulnerability reports, increasing the average bounty to $1,790 and total payouts to $155,750, and improving time to bounty to 30 days and resolution to 19 days. It also highlights an increase in the percentage of resolved reports to 11.3% and discusses areas for future improvement such as increasing the total number of resolved reports and the number of contributing hackers.
Feb 20182017 Bug Bounty Year in Review - ShopifyThis post details the evolution of Shopify's bug bounty program in 2017, highlighting key achievements such as the highest payout to date ($20,000), participation in the H1-415 event, and significant increases in average bounty payouts and total amount paid to hackers. It also discusses improvements in response and triage times, a decrease in invalid reports, and a slight increase in resolved reports. The post announces upcoming changes to the program, including quicker payments, better program clarity, and earlier access to new features for hackers.
Feb 2017Sharing the Philosophy Behind Shopify's Bug Bounty - ShopifyThis post details the evolution of Shopify's bug bounty program, highlighting the introduction of a high minimum payout ($500) to attract researchers, the commitment to full public disclosure of vulnerabilities post-resolution, and the educational aspect of explaining why certain findings are or are not issues. It provides three specific examples of vulnerabilities discovered: 'The Case of the Invoice Swap' (a URL manipulation bug leading to data exposure), 'The Case of the Sneaky Catfish' (a livechat access token theft vulnerability), and 'The Case of the Remote Code Execution' (a vulnerability in shopify-scripts allowing for memory writes leading to RCE).