Making Open Source Safer for Everyone with Shopify’s Bug Bounty Program - Shopify

This post details a specific contribution to the Rails library inspired by a bug bounty report. The report demonstrated a deserialization vulnerability in `ActiveSupport::MessageEncryptor` due to its default use of the unsafe `Marshal` serializer. Shopify's contribution involved patching their internal applications to use JSON serialization and then contributing upstream to change the default serializer in Rails versions 7.1.X and above for both `MessageEncryptor` and `MessageVerifier`. Additionally, Shopify developed a patch to hook `Marshal.load` and `Marshal.dump` to track and deprecate its use in production environments, encouraging safer serialization practices.