Shopify job-iteration

Skip to content What this pays sorona.xyz pays 1.25× the program's reward, up to +$1,000 per finding, plus a complexity bonus of up to $1,000 for especially complex or well-chained bugs. Finding │ Program pays │ Through sorona.xyz Critical or High (repo capped at Medium severity) │ $14,000 │ $15,000 Medium │ $14,000 │ $15,000 Low │ $1,000 │ $1,250 Submit a vulnerability CVE history 0 Last 12 months 1 Lifetime Access control 30 % Injection 25 % Parsing/validation 25 % Denial of service 15 % Latest advisories Loading the feed Overview job-iteration is the standard answer in the Rails world to the problem of long-running background jobs that must survive a deploy: it checkpoints a cursor, lets the job be interrupted, and resumes it where it stopped. It was extracted from Shopify's own job infrastructure, among the largest Ruby workloads in existence, and it is a direct dependency of Shopify's widely adopted maintenance_tasks engine, which gives it a transitive footprint well beyond its 1,306 stars. Its blast radius is queue integrity rather than request handling: a cursor-deserialization or checkpoint bug means jobs that reprocess, skip, or process another tenant's records, which in a commerce context means money. Shopify pays it through one of the most active and best-funded programs on HackerOne, though the open-source wildcard is a Non-core asset capped at Medium severity, so the reachable band is $1,000 to $14,000 rather than the $200,000 program headline. sorona.xyz adds 1.25× on top of whatever Shopify awards, up to $1,000 more, plus a complexity bonus of up to $1,000 for a well-chained finding. Response times ~5 days First response ~13 days Triage ~12 days Bounty In scope Shopify's program takes public repositories in the Shopify GitHub organisation as one source-code asset, https://github.com/Shopify/* , marked Non-core and capped at medium severity. Shopify/job-iteration sits inside that namespace, so a security issue anywhere in the gem is accepted, priced at $1,000 to $14,000 The JobIteration::Iteration module: build_enumerator , each_iteration , and the contract they impose on a job class The enumerator builders for ActiveRecord records and batches, arrays, CSV and nested sources, and the cursor each of them emits Cursor and checkpoint handling: how a cursor is serialized into job arguments, stored, and read back on resume Interruption and resumption, covering the interruption adapters, the maximum job runtime, and the exactly-once and at-least-once boundaries Throttling, the throttle enumerators, and the backoff that decides when a job is told to stop and reschedule itself Integration with ActiveJob and the queue adapters underneath it, Sidekiq, Resque and SQS among them, where the adapter's own guarantees can be subverted The published job-iteration RubyGem, its release process and its packaging integrity Out of scope The medium-severity cap on this asset: the $50,000 and $200,000 cells cannot be reached from a source-code finding however it scores Non-Shopify GitHub repositories and forks, which fall outside the org-wide wildcard Reports with no functional proof of concept, which the program closes rather than triages Findings that cannot be tied to CVSS impact on Shopify, its merchants, or its partners ActiveJob, Sidekiq, Resque and the other queue backends, which are other projects' code even where job-iteration drives them Best-practice and non-security findings, and duplicates that share a root cause with an existing submission Anything that requires contacting Shopify Support to demonstrate, which is itself a disqualifier Most-valued findings Cursor or checkpoint deserialization that lets crafted state drive a resumed job into records it was never meant to touch, the highest-consequence class in this library Authorisation-shaped failures where a resumed job processes another tenant's rows, which at 30% is the largest recorded class here Injection through enumerator inputs, particularly the ActiveRecord and CSV enumerators, where cursor values reach a query Parsing and validation bugs in cursor decoding that survive a deploy and reappear as silently skipped or reprocessed batches Denial of service where a job can be made permanently unresumable or forced to loop over the same batch indefinitely Supply-chain findings on the published RubyGem that would reach every application depending on it Program rules Submit through sorona.xyz first. We validate, coordinate with the program's security team, and add the payout uplift on top of whatever it awards. The github.com/Shopify/* wildcard is capped at max_severity Medium, so the $50,000 and $200,000 cells cannot be reached from a source-code finding no matter how it scores A functional proof of concept is required; reports without one are closed Tie the finding to CVSS impact on Shopify, its merchants, or its partners, or it will not be treated as a vulnerability Best-practice and non-security observations are not eligible, and duplicates sharing a root cause with an existing submission pay nothing Do not contact Shopify Support about a report; doing so is itself a disqualifier Submitting content to Shopify waives your moral rights in it and licenses it under MIT, which is why routing here is handled carefully Program stats 2,420 Reports resolved $9.46M Bounties paid 42% Response efficiency Disclosure Coordinated through Shopify on HackerOne, and the submission terms are unusually broad: content you submit is licensed to Shopify under MIT with your moral rights waived. Because a sorona.xyz-routed report can be read as breaching those terms, file with Shopify directly and let sorona.xyz track the outcome rather than stand between you and the payer. Safe harbor Sorona will not pursue legal action against you for good-faith research submitted to us in line with this policy. We cannot speak for the upstream project, its vendor, or any third party, and we do not grant authorization on their behalf. You are responsible for understanding and following the laws that apply to you, wherever you are, and for staying within any scope the project has defined. Submit a vulnerability