Building Shopify’s Application Security Program - Shopify

This post outlines the foundational principles and early strategies for building Shopify's application security program. It emphasizes standardization of the technology stack (Ruby on Rails), gaining visibility into services and dependencies, and the growth of the security team through specialization (fraud, appsec, infra, etc.). It also highlights the use of external validation like penetration testing and bug bounty programs, and the importance of fast, automated, and risk-aware security interactions. Specific tactics mentioned include renaming dangerous methods like `html_safe` to `dangerously_output_as_html` and triggering alerts for the appsec team. The post also touches on embedding security decisions at the infrastructure level.