- Top reward
- $15,000
- Top severity paid
- Medium
- Assets in scope
- 10
- Public CVEs
- 0
- Last change
- No changes yet
At a glance
What to know before you start testing.
- Pays up to $15,000
- for medium bugs, from $1,250.
- Report on Sorona
- Submit through the program page.
- Partial safe harbor
- Some legal protection; read the terms.
- Replies within 5 days
- As the policy promises.
- Publish after a fix
- Coordinate the timing with the company.
Rewards
What Sorona lists as the payout for each severity.
| Severity | Relative size | Reward |
|---|---|---|
| Medium |
|
$15,000 |
| Low |
|
$1,250 |
- Response
-
Within 5 days
~5 days First response
- Safe harbor
-
Partial
Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf.
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Scope
10 assets you may test, 7 excluded.
Web 1
- https://github.com/Shopify/identity_cache
Products and areas 9
- Cache-key construction, namespacing and the schema-derived cache version that is supposed to keep one model's entries apart from another's
- Expiry and invalidation, covering the after-commit hooks, parent-record expiry through embedded associations, and the transaction boundaries they hang off
- fetch, fetch_by_*, fetch_multi and fetch_multi_by_*, including embedded association loading and the index-to-record indirection underneath them
- Serialization and deserialization of cached ActiveRecord objects: the coder that writes an entry and the attribute set that comes back out
- Shopify's program takes public repositories in the Shopify GitHub organisation as one source-code asset, https://github.com/Shopify/*, marked Non-core and capped at medium severity. Shopify/identity_cache sits inside that namespace, so a security issue anywhere in the gem is accepted, priced at $1,000 to $14,000
- The cache_index, cache_belongs_to, cache_has_many and cache_has_one declarations and the fetch methods they generate
- The configuration surface: read-only and fallback fetching, should_use_cache?, and the Railtie wiring that turns the gem on inside an application
- The Memcached client integration, its connection handling, and the fill-lock path that guards a cold key against a stampede
- The published identity_cache RubyGem, its release process and its packaging integrity
Out of scope (7)
- ActiveRecord and Rails behaviour that identity_cache only inherits, which belongs upstream
- Best-practice observations, and duplicates sharing a root cause with a report already filed
- Findings that cannot be argued to CVSS impact on Shopify or its merchants
- Findings with no working proof of concept
- Repositories outside the Shopify organisation, plus forks and archived repositories, none of which the wildcard covers
- The medium-severity cap on this asset: the $50,000 and $200,000 cells cannot be reached from a source-code finding however it scores
- Vulnerabilities in Memcached itself, which is a separate project running no bounty at all
Rules
What the policy asks of you, and the bug types it won't reward, quoted from Sorona's policy.
While testing
-
A working proof of concept is required; a described bug without one is not eligible
-
Argue the finding to CVSS impact on Shopify or its merchants, since impact on a downstream application is what the program scores
-
Best-practice observations and duplicates sharing a root cause with an existing report are not paid
-
Bugs in Memcached itself belong to Memcached, which runs no bounty at all, so keep the finding inside the gem
Not accepted
-
Findings with no working proof of concept
-
Findings that cannot be argued to CVSS impact on Shopify or its merchants
-
Best-practice observations, and duplicates sharing a root cause with a report already filed
Summarised with AI from the program policy on Sorona, read 12 Nov 2026, and checked word for word against it. Read the original
Changes
Tracked since 11 Nov 2026. Last checked 1 hour ago.
No changes yet. When the rewards or scope move, you will see it here and in the RSS feed.
Public CVEs
Published vulnerabilities in this vendor's products, from the NVD.
No CVEs matched yet. We match NVD records by vendor name, so products sold under another name can be missing.
Original policy
Copied from sorona.xyz on 12 Nov 2026. The summaries on this page are made from it; the live page may have changed since.
Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical or High (repo capped at Medium severity) │ $14,000 │ $15,000 Medium │ $14,000 │ $15,000 Low │ $1,000 │ $1,250 Submit a vulnerability CVE history 0 Last 12 months 0 Lifetime Info disclosure 35 % Access control 30 % Code execution 20 % Parsing/validation 10 % Latest advisories Loading the feed Overview identity_cache is one of the most widely used caching layers in the Rails ecosystem, and one of the few extracted directly from a hyperscale commerce workload: Shopify runs it in front of the database tier serving millions of merchant storefronts. Its 1,967 stars understate its real position, because caching libraries are adopted by the largest applications rather than the most numerous ones. The security consequence of a caching layer is specific and severe: a cache-key collision or a stale-invalidation bug is a cross-tenant data-disclosure bug by construction, serving one merchant's records to another. Shopify pays it on an open and active HackerOne program, but the open-source wildcard is a Non-core asset capped at Medium severity, so the reachable band is $1,000 to $14,000 rather than the $200,000 program headline. sorona.xyz adds 1.25× on top of whatever Shopify awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~5 days First response ~13 days Triage ~12 days Bounty In scope Shopify's program takes public repositories in the Shopify GitHub organisation as one source-code asset, https://github.com/Shopify/* , marked Non-core and capped at medium severity. Shopify/identity_cache sits inside that namespace, so a security issue anywhere in the gem is accepted, priced at $1,000 to $14,000 Cache-key construction, namespacing and the schema-derived cache version that is supposed to keep one model's entries apart from another's The cache_index , cache_belongs_to , cache_has_many and cache_has_one declarations and the fetch methods they generate fetch , fetch_by_* , fetch_multi and fetch_multi_by_* , including embedded association loading and the index-to-record indirection underneath them Serialization and deserialization of cached ActiveRecord objects: the coder that writes an entry and the attribute set that comes back out Expiry and invalidation, covering the after-commit hooks, parent-record expiry through embedded associations, and the transaction boundaries they hang off The Memcached client integration, its connection handling, and the fill-lock path that guards a cold key against a stampede The configuration surface: read-only and fallback fetching, should_use_cache? , and the Railtie wiring that turns the gem on inside an application The published identity_cache RubyGem, its release process and its packaging integrity Out of scope The medium-severity cap on this asset: the $50,000 and $200,000 cells cannot be reached from a source-code finding however it scores Repositories outside the Shopify organisation, plus forks and archived repositories, none of which the wildcard covers Findings with no working proof of concept Findings that cannot be argued to CVSS impact on Shopify or its merchants Vulnerabilities in Memcached itself, which is a separate project running no bounty at all ActiveRecord and Rails behaviour that identity_cache only inherits, which belongs upstream Best-practice observations, and duplicates sharing a root cause with a report already filed Most-valued findings Cache-key collision or namespacing failure that serves one tenant's cached records to another, the disclosure class that carries 35% of this library's recorded bugs and its highest-value shape Stale or missed invalidation on the after-commit path that keeps serving data a write was supposed to remove, including records deleted for privacy reasons Deserialization of a poisoned cache entry into live ActiveRecord objects, the route from cache write access to code execution fetch_multi_by_* index handling that returns records outside the caller's intended set, an access-control failure expressed as a cache lookup Any of the above shown on a default configuration rather than one the reporter had to weaken first Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The github.com/Shopify/* wildcard is capped at max_severity Medium, so the $50,000 and $200,000 cells are unreachable from a source-code finding however it scores A working proof of concept is required; a described bug without one is not eligible Argue the finding to CVSS impact on Shopify or its merchants, since impact on a downstream application is what the program scores Best-practice observations and duplicates sharing a root cause with an existing report are not paid Bugs in Memcached itself belong to Memcached, which runs no bounty at all, so keep the finding inside the gem Submitting content to Shopify waives your moral rights in it and licenses it under MIT, which is why routing here is handled carefully Program stats 2,420 Reports resolved $9.46M Bounties paid 42% Response efficiency Disclosure Coordinated through Shopify on HackerOne. The submission terms license your report content to Shopify under MIT with moral rights waived, which a sorona.xyz-routed report could be read as breaching, so file with Shopify directly and let sorona.xyz track the outcome rather than stand between you and the payer. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability