Bug Bounty Program and Security Vulnerability Management

6/15/2022

This post details a specific contribution to the Rails library inspired by a bug bounty report. It describes how a deserialization vulnerability in Rails' MessageEncryptor and MessageVerifier, which defaulted to using the unsafe Marshal serializer, was identified. The post explains the fix implemented in Shopify's internal systems (switching to JSON serializer) and the subsequent contribution to Rails to change the default serializer to JSON for MessageEncryptor and MessageVerifier in versions 7.1.X and beyond. It also provides a patch for Ruby applications to track and deprecate the use of Marshal.

3/22/2022

This post details the evolution of Shopify's Bug Bounty program, specifically highlighting the increase in the maximum bounty payout to $100,000 for CVSS 10.0 issues in 2022. It also announces that Shopify Plus, Shop, and Shop Pay are now considered core services, meaning High and Critical bugs in these areas will be paid according to the new scale. The post reviews 2021 program highlights, including over $1 million in bounties paid, the first full year of CVSS-based bounties, and a focus on open-source security. Statistics for 2021 are presented, showing an increase in valid reports and a decrease in non-applicable issues. Average bounty payouts increased, and response times were analyzed, with a significant decrease in time to bounty.

3/11/2021

This post details several key updates and improvements to Shopify's Bug Bounty program in 2021. It highlights the success of the H1-2102 Virtual Live Hacking Event, significant bounty milestones including over $2 million awarded in total and over $460,000 in 2020, and the adoption of the Common Vulnerability Scoring System (CVSS) for bounty calculation, including the release of a public calculator. A GraphQL Hacking Guide was released to aid researchers. Program improvements include the creation of a dedicated Bug Bounty Team to improve response times, the expansion of Bug Bounty Resources on GitHub, enhanced follow-up responses for hacker inquiries, and the relaunch of the Shopify Experiments private program with new criteria for invitations. The post also presents 2020 Bug Bounty Statistics, showing a substantial increase in report volume.

2/6/2020

This post details improvements to Shopify's Bug Bounty program in 2019, including a 7-day bounty payout policy, an increased maximum bounty to $50,000 (with specific increases for ACE, SQLi, and Privilege Escalation), and better surfacing of information about duplicate reports. It also discusses learning from peers, improving analytics by leveraging provisioned accounts for testing frequency insights, and running experiments in a private program (Shopify-Experiments) such as expanding scope and refining response automation. Automation for incident management was improved with shorthands and emoji responses for Slack-based report handling. Statistics highlight reduced average response, triage, bounty, and resolution times, alongside an increase in disclosed bugs. Total bounties paid and average bounty awarded decreased compared to the previous year, partly due to a large payout event in 2018 and the merging of the Shopify Scripts bounty program.

4/3/2019

This post announces that Shopify has awarded over $1M USD in bug bounties through its programs on HackerOne. It provides statistics on the program's performance (over 400+ hackers, 950+ bugs resolved, 750+ bounties awarded, 375+ public disclosures) and details three significant vulnerabilities: SSRF in Exchange leading to ROOT access ($25K bounty), an authentication bypass using partners.shopify.com ($20K bounty), and stored XSS in the admin and partner pages ($5K bounty). The post also mentions ongoing efforts to enhance the program's competitiveness and attractiveness to researchers.

12/20/2018

This post details the year-in-review for Shopify's Bug Bounty program in 2018. Key technical contributions include a reduction in average time to triage from four days to 10 hours, achieved by dedicating one team member per week to HackerOne triage and implementing a tiered validation process for critical, high, medium, and low severity reports. The post also describes the technical aspects of the H1-514 live hacking event, including opening submissions early, disclosing resolved reports during the event, using innovative bonuses for specific bug types (GraphQL, race conditions), and providing shell access to infrastructure. It also presents statistics on bounty payouts, response times, triage times, and report resolution rates, highlighting improvements in efficiency and effectiveness.

2/22/2018

This post details the 2017 year in review for Shopify's Bug Bounty program. It highlights specific high-value bug reports and their technical root causes (e.g., incorrect logic in collaborator account conversion, race condition in partner auto conversions, XSS in SVG parser and storefront). It also covers participation in the H1-415 hacking event, detailing the event's structure, outcomes (bugs resolved, payouts), and the insights gained into hacker methodologies. Statistical analysis of the program's performance in 2017 is provided, including average bounty increases, total payouts, response and triage times, and the percentage of resolved vs. invalid reports. Finally, it announces program changes for 2018, including quicker payments for triaged reports, improved program clarity, and early feature access for hackers.

2/16/2017

This post details the philosophy and impact of Shopify's Bug Bounty program. It highlights the program's evolution since 2012, its partnership with HackerOne since 2015, and the significant number of fixes and bounties awarded. Specific examples of vulnerabilities like 'Invoice Swap', 'Sneaky Catfish', and 'Remote Code Execution' are provided with technical explanations of the bugs and their resolutions, including the bounty amounts and disclosure timelines. The post emphasizes the program's role in maintaining merchant trust and its educational value.