Shopify’s Bug Bounty Program Raises Maximum Payout in 2022 - Shopify

This post details the evolution of Shopify's bug bounty program by doubling the maximum bounty payout to $100,000 for CVSS 10.0 issues and increasing payouts for High and Critical severity bugs. It also designates Shopify Plus, arrive-server.shopifycloud.com, and shop.app as core assets, meaning critical bugs in these services will be paid according to the new scale. The post also highlights the program's success in 2021, paying out over $1 million in bounties, and the first full year of CVSS-based bounties, leading to more consistent decisions and productive discussions. Additionally, it announces the creation of a "Bug Bounty Resources" GitHub repository with guides and a CVSS scoring guide, and reiterates Shopify's commitment to supporting open-source security through sponsorships.