Updates on Shopify's Bug Bounty Program 2021 - Shopify

This post details the evolution of Shopify's Bug Bounty program in 2020 and early 2021. Key contributions include: increased maximum bounty to $50,000, leading to critical vulnerability reports in Shopify ID; awarding over $2 million in total bounties and over $460,000 in 2020; successful implementation of CVSS for bounty calculation, increasing transparency and objectivity; release of a GraphQL Hacking Guide to reduce barriers for researchers; creation of a dedicated bug bounty team to improve response times and reduce duplicates; development of tooling to surface reports requiring follow-up; and the upcoming relaunch of the Shopify Experiments private program with a revised focus on special apps and features.