- Top reward
- $15,000
- Top severity paid
- Medium
- Assets in scope
- 11
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $15,000
- for medium bugs, from $1,250.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Medium |
|
$15,000 |
| Low |
|
$1,250 |
- Response
-
Within 5 days
~5 days First response
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
11 assets you may test, 7 excluded.
Web 1
- https://shipit-engine.github.io
Products and areas 10
- Authentication, team membership and the authorisation rules for who may trigger, lock, roll back or reconfigure a stack
- Background job processing and the task-output streaming the dashboard reads
- Command execution, where Shipit shells out to deploy scripts, to git and to a stack's configured tooling on the deploy host
- Per-stack environment variables, deploy secrets and the paths that carry them into logs, task output and the dashboard
- Shopify's program takes public repositories in the Shopify GitHub organisation as one source-code asset, https://github.com/Shopify/*, marked Non-core and capped at medium severity. Shipit Engine is one of those repositories, so a security issue anywhere in it is accepted, priced at $1,000 to $14,000
- The deploy orchestration core: stacks, tasks, deploy locking and the concurrency rules that decide when a deploy may run
- The GitHub integration: OAuth sign-in, the API client, and webhook ingestion together with its signature verification
- The JSON API and its API-client tokens, which give machine callers the same deploy authority through a different door
- The merge queue and the continuous-delivery scheduler, which merge pull requests and start deploys with no human in the loop
- The Rails engine's own web surface, its controllers, views and assets, as mounted inside a host application
Out of scope (7)
- Archived Shopify repositories, which the program does not cover because they are not maintained
- A vulnerable dependency asserted on its own, with no exploit chain reaching Shipit itself
- Missing security headers, cookie flag findings, and TLS configuration observations
- Repositories outside the Shopify organisation, including forks of Shipit maintained elsewhere
- Self-XSS and clickjacking without a demonstrated path to impact
- Shopify's own core platform and its hosted properties, which are separate asset rows on the same program rather than part of this one
- The medium-severity cap on this asset: the High and Critical bands cannot be awarded however a Shipit finding scores, and non-core scoring sets the Confidentiality, Integrity and Availability Requirement modifiers to Low on top of that
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
Submit through sorona.xyz first.
-
Max severity on this asset is Medium, so however the bug scores, the High and Critical bands cannot be awarded
-
Findings in archived Shopify repositories are not covered, so check the repo is still maintained before you invest time
-
A vulnerable dependency on its own is not a report; show the exploit chain through Shipit itself
-
Keep proof-of-concept video inside the HackerOne report rather than on YouTube or a public host until the report is disclosed
Not accepted
-
Missing security headers, cookie flag findings, and TLS configuration observations
-
Self-XSS and clickjacking without a demonstrated path to impact
-
A vulnerable dependency asserted on its own, with no exploit chain reaching Shipit itself
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical or High (repo capped at Medium severity) │ $14,000 │ $15,000 Medium │ $14,000 │ $15,000 Low │ $1,000 │ $1,250 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Access control 35 % Code execution 30 % Injection 20 % Info disclosure 10 % Latest advisories Loading the feed Overview Shipit Engine is the deployment tool Shopify built to ship one of the largest Rails applications in the world, then open-sourced as a self-hosted Rails engine. Its footprint is much narrower than a GitLab Runner, but the software's whole job is holding production deploy credentials and executing deploy scripts on demand, which makes any organisation running it a high-value compromise. It has no CVE record at all, which on a deployment orchestrator is a signal about attention rather than about safety. Shopify pays it through one of the largest programs on HackerOne by lifetime payout, under the org-wide rule that public repositories in the Shopify organisation are Non-core assets capped at Medium severity, so the reachable band runs $1,000 to $14,000. sorona.xyz adds 1.25× on top of whatever Shopify awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~5 days First response ~13 days Triage ~12 days Bounty In scope Shopify's program takes public repositories in the Shopify GitHub organisation as one source-code asset, https://github.com/Shopify/* , marked Non-core and capped at medium severity. Shipit Engine is one of those repositories, so a security issue anywhere in it is accepted, priced at $1,000 to $14,000 The deploy orchestration core: stacks, tasks, deploy locking and the concurrency rules that decide when a deploy may run Command execution, where Shipit shells out to deploy scripts, to git and to a stack's configured tooling on the deploy host The GitHub integration: OAuth sign-in, the API client, and webhook ingestion together with its signature verification Authentication, team membership and the authorisation rules for who may trigger, lock, roll back or reconfigure a stack The JSON API and its API-client tokens, which give machine callers the same deploy authority through a different door The merge queue and the continuous-delivery scheduler, which merge pull requests and start deploys with no human in the loop Per-stack environment variables, deploy secrets and the paths that carry them into logs, task output and the dashboard The Rails engine's own web surface, its controllers, views and assets, as mounted inside a host application Background job processing and the task-output streaming the dashboard reads Out of scope The medium-severity cap on this asset: the High and Critical bands cannot be awarded however a Shipit finding scores, and non-core scoring sets the Confidentiality, Integrity and Availability Requirement modifiers to Low on top of that Archived Shopify repositories, which the program does not cover because they are not maintained Repositories outside the Shopify organisation, including forks of Shipit maintained elsewhere Shopify's own core platform and its hosted properties, which are separate asset rows on the same program rather than part of this one Missing security headers, cookie flag findings, and TLS configuration observations Self-XSS and clickjacking without a demonstrated path to impact A vulnerable dependency asserted on its own, with no exploit chain reaching Shipit itself Most-valued findings Authorisation bypass that lets a user without deploy rights trigger, lock, or roll back a deploy on a stack they do not own, the largest class here at 35% Command injection through deploy-script arguments, stack configuration, or the git invocations Shipit makes, which turns into code execution on a host holding production credentials Forged GitHub webhooks that pass signature verification and drive a deploy from an unauthenticated request Merge-queue or continuous-delivery paths that land a revision without the review those mechanisms exist to enforce Deploy-lock or concurrency flaws that let two deploys interleave and land a revision nobody approved Any leak of deploy secrets or per-stack configuration into logs, job output, or the dashboard Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. Max severity on this asset is Medium, so however the bug scores, the High and Critical bands cannot be awarded Severity is reduced further by policy: non-core properties are scored with Environment Score modifiers set to Low for Confidentiality, Integrity and Availability Requirements Findings in archived Shopify repositories are not covered, so check the repo is still maintained before you invest time A vulnerable dependency on its own is not a report; show the exploit chain through Shipit itself Keep proof-of-concept video inside the HackerOne report rather than on YouTube or a public host until the report is disclosed Program stats 2,420 Reports resolved $9.46M Bounties paid 42% Response efficiency Disclosure Coordinated through Shopify on HackerOne. The policy carries no confidentiality or exclusivity clause, so the only real constraint is that supporting video stays in the report until disclosure, and the program discloses resolved reports in the ordinary HackerOne way. sorona.xyz holds your finding until Shopify has resolved it. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability