Shopify bug bounty programs
shopify.com Updated
Shopify runs two public programs: a HackerOne bug bounty paying up to $200,000 and a self-hosted bug bounty paying up to $200,000.
- Top reward
- $200,000
- HackerOne
- Programs
- 2
- 2 pay cash
- Targets in scope
- 24
- 4 types, deduplicated
- Last change
- 10 Nov 2026
- 2 days ago
Where to report
2 programs, side by side. Report where the affected target is in scope; when two programs cover it, pick the one that pays more.
Start here
Shopify
HackerOne · Pays the most of the 2 programs: up to $200,000.
| Program | Critical | High | Medium | Low | Top reward | Safe harbor | KYC | First response | Status |
|---|---|---|---|---|---|---|---|---|---|
Shopify
HackerOne · Bug bounty |
$200k (highest) | $50k (highest) | $14k (highest) | $1,000 (highest) | $200,000 | – | – | 3 days average | Open |
|
Shopify
Self-hosted · Bug bounty |
– | – | – | – | $200,000 | Full | – | – | Open |
-
- Critical
- $200k (highest)
- High
- $50k (highest)
- Medium
- $14k (highest)
- Low
- $1,000 (highest)
- First response
- 3 days average
-
- Safe harbor
- Full
Amounts are the top reward per severity in the currency each program pays. Green marks the highest per severity. First response is the platform's measured average when it publishes one, else what the policy promises.
What is in scope
24 targets across all 2 programs, each listed once with the programs that cover it. 10 excluded.
No target matches. Try part of a host name, such as the company name.
Out of scope 10
Don't test these. A program can exclude a host another program covers; the program you report to decides.
-
*.email.shopify.com
HackerOne
-
cdn.shopify.com
HackerOne
-
community.shopify.com
HackerOne
-
community.shopify.dev
HackerOne
-
livechat.shopify.com
HackerOne
-
shopify.photo
HackerOne
-
shopifyevents.com
HackerOne
-
shopifypartnerships.com
HackerOne
-
Other
HackerOne
-
supplier-portal.shopifycloud.com
HackerOne
Recent changes
Reward and scope changes across every Shopify program, newest first.
-
Scope + HackerOne
Added to scope: shop.com
-
Scope + HackerOne
Added to scope: shopify.photo
-
Scope + HackerOne
Added to scope: help.shop.app
-
Scope + HackerOne
Added to scope: shopifypartnerships.com
-
Scope + HackerOne
Added to scope: Shop Minis
-
Scope + HackerOne
Added to scope: *.shopifysvc.com
-
Scope + HackerOne
Added to scope: shopifyevents.com
-
Scope + HackerOne
Added to scope: Sidekick
Recent CVEs
Published vulnerabilities in Shopify products, from the NVD.
-
CVE-2026-55685 High
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<Router
-
CVE-2026-55685 High
React Router is a router for React. In versions 7.0.0 through 7.17.0, the manifest endpoint could be accessed via unauthenticated targeted requests that would put heavy load on the server and slow down response times. This issue is a follow up to CVE-2026-42342, and does not does not impact React Router applications using Declarative Mode (<BrowserRouter>) or Data Mode (createBrowserRouter/<Router
-
CVE-2026-53667 Medium
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
-
CVE-2026-53669 Medium
React Router is a router for React. Versions 6.0.0 through 7.17.0 are vulnerable to Open Redirtect through use of backslashes in <Link> and useNavigate. This issue is a follow up to CVE-2025-68470 and has been fixed in version 7.18.0.
-
CVE-2026-53666 Medium
React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very sp
-
CVE-2026-53668 Medium
React Router is a router for React. In versions 6.30.2 through 6.30.4 and 7.9.6 through 7.12.0, applications that allow open redirects are vulnerable to XSS. An attacker could craft a malicious link that redirects users to an unexpected external site or that exploits an XSS vector.This issue has been fixed in version 7.13.0.
-
CVE-2026-53667 Medium
React Router is a router for React. In versions 7.11.0 through 7.17.0, the RSCErrorHandler is missing protocol validation, allowing for redirects from untrusted sources. This issue is a follow up to CVE-2026-53667, and only affects consuming applications if they are using the unstable RSC APIs. This issue has been fixed in version 7.18.0.
-
CVE-2026-53666 Medium
React Router is a router for React. In versions 6.4.0 through 7.17.0, if application code was written in a way that allows attacker-supplied input to overwrite certain aspects of errors caught by the SSR process, then it was possible for an attacker to trigger unexpected constructor execution on the client, which would in turn trigger an outbound network request. This is only possible with very sp
About this page
This page gathers every public program listed under shopify.com: platform programs, self-hosted policies and security.txt contacts. Each program's own policy decides what is in scope and what it pays; check it before you test.
Something wrong or missing? Report a correction.