Bug Bounty Year in Review 2018 - Shopify

This post details the 2018 year-in-review for Shopify's Bug Bounty program. Key contributions include: reducing average time to triage to 10 hours, hosting the H1-514 live hacking event in Montreal which yielded over 50 valid vulnerability reports, increasing the average bounty to $1,790 and total payouts to $155,750, and improving time to bounty to 30 days and resolution to 19 days. It also highlights an increase in the percentage of resolved reports to 11.3% and discusses areas for future improvement such as increasing the total number of resolved reports and the number of contributing hackers.