--- title: "Shopify" description: "Global commerce platform powering millions of businesses with essential infrastructure and innovative engineering solutions." --- # Shopify > Global commerce platform powering millions of businesses with essential infrastructure and innovative engineering solutions. ## Articles ### [Pair Programming Explained](https://yomu.fyi/post/pair-programming-explained.md) - Company: [Shopify](https://yomu.fyi/company/shopify.md) - Author: 2023-10-18 - Published: May 9, 2019 Pair Programming Explained presents pair programming as two people writing, debugging, or exploring code together, while explaining why Shopify uses it for knowledge sharing, collective ownership, learning, quality, and onboarding. It defines terms including problem, solution, driver, navigator, expert, novice, and disengagement, and stresses that the driver handles implementation while the navigator guides broader strategy and spots errors. Guidance covers when to pair, the trade-offs among expert-expert, expert-novice, and novice-novice combinations, and the risks of “watch the master” or disengagement. Suggested practices include switching roles with the Pomodoro Technique, using Strong Style or Digging for Gold, and holding a retrospective to discuss flow, learning, and tension. The article presents pairing as a focused collaborative practice that benefits from shared attention, regular breaks, and deliberate communication rather than an unstructured coding session. ### [A New Kubectl Plugin for Kubernetes Ingress Controller ingress-nginx](https://yomu.fyi/post/a-new-kubectl-plugin-for-kubernetes-ingress-controller-ingress-nginx.md) - Company: [Shopify](https://yomu.fyi/company/shopify.md) - Author: 2023-10-18 - Published: May 1, 2019 Shopify contributed a kubectl plugin to ingress-nginx, an open-source Kubernetes Ingress controller built on NGINX, because debugging and upgrading the heavily used controller often required long, frustrating sequences of kubectl commands. The plugin’s lint subcommand identifies ingress configuration that may need changes for a new release, while richer ingress listings expose individual paths, target services, and TLS configuration. It also wraps common kubectl operations, automatically selects an ingress pod, and helps inspect generated nginx.conf and dynamic configuration managed with openresty lua-nginx-module. The author reports substantially faster upgrades and debugging, comparing a rollout to version 0.24.1 with an earlier upgrade to 0.22.0 that took days, while acknowledging that growing Kubernetes expertise also contributed. Released with ingress-nginx 0.24.0, the plugin should also be compatible with 0.23.0. ### [Building Shopify’s Application Security Program](https://yomu.fyi/post/building-shopify-s-application-security-program.md) - Company: [Shopify](https://yomu.fyi/company/shopify.md) - Author: 2023-10-18 - Published: Apr 26, 2019 Shopify's application security program is designed to preserve safety while products and services scale quickly across a platform serving more than 800,000 merchants. It organizes the work around scaling secure applications, scaling security teams, and scaling security interactions, with a culture that treats security as a non-negotiable priority. Standardizing on Ruby on Rails and other shared technologies lets tooling go deep, while service tracking provides visibility into applications, dependencies, code, and automated dependency updates. The security organization grew from one employee into specialized teams, supplemented by penetration testing, bug bounties, and audits, while incident response remains shared across the company. At the code level, tripwires detect dangerous patterns early; Shopify renamed html\_safe to dangerously\_output\_as\_html, links flagged pull requests to XSS training, and alerts Application Security, shifting review toward automation. ### [One Million Dollars in Bug Bounties](https://yomu.fyi/post/one-million-dollars-in-bug-bounties.md) - Company: [Shopify](https://yomu.fyi/company/shopify.md) - Author: 2023-10-18 - Published: Apr 3, 2019 Shopify announces that it has awarded more than $1M USD through its bug bounty programs, which complement its security strategy by bringing in researchers with varied perspectives to assess the platform. The company says it is the fifth public program among 176 on HackerOne to reach that milestone, after four years of working with researchers. It describes three resolved vulnerabilities: an SSRF in Shopify Exchange that could provide root access within one infrastructure subset, an admin authentication bypass involving duplicate partner accounts, and stored cross-site scripting from improperly sanitized sales-channel SVG files. Shopify disabled or audited affected services, deployed a metadata-concealment proxy, corrected account verification, removed unnecessary admin functionality, and checked for exploitation. It plans to experiment with ways to increase hacker engagement and make the program more attractive. ### [Meet Shopify Developer Kirsten Westeinde - Shopify](https://yomu.fyi/post/meet-shopify-developer-kirsten-westeinde-shopify.md) - Company: [Shopify](https://yomu.fyi/company/shopify.md) - Author: 2023-10-18 - Published: Mar 22, 2019 Kirsten Westeinde’s just-over-five-year Shopify career spans internal tools, partner-facing applications, and backend development on Kit as the company scaled. She began with Ruby on Rails, later helped extract partner software from Shopify Core using Elasticsearch, Kafka, Ruby on Rails, and the Shopify API, and now works with Data Engineering on real-time recommendations. The feature combines Go and Ruby and is designed to handle the current load while scaling to future demand. Her problem-solving practices include whiteboarding system interactions, taking mental breaks, and writing or explaining ideas to align collaborators. She also describes mentorship, pair programming, a women’s developer meetup, and f(empower) as ways to support growth and address exclusion, bias, and microaggressions in technology. ### [Shopify Devs Share Lessons on Self-Advocacy and Dealing with Adversity - Shopify](https://yomu.fyi/post/shopify-devs-share-lessons-on-self-advocacy-and-dealing-with-adversity.md) - Company: [Shopify](https://yomu.fyi/company/shopify.md) - Author: 2023-10-18 - Published: Mar 8, 2019 Shopify’s Behind The Code series profiles Stella Lee, Helen Lin, and Cathryn, three developers discussing self-advocacy, adversity, management, inclusion, and career changes in technology. Lee describes building Shopify Checkout Experience features in TypeScript and Ruby to reduce manual checkout fields, while leading the f(empower) women’s employee resource group; she also discusses imposter syndrome, mentorship, and turning initial “stupid” questions into better ones through timeboxing and research. Lin, a remote Themes team lead, emphasizes aligning projects with long-term company vision, managing stakeholders, staying connected, and directly requesting career opportunities while sharing accomplishments. Cathryn recounts moving from health sciences into programming and stresses evaluating personal goals, hiring a more diverse workforce, and using meeting-room paper pyramids to support inclusive discussion. The article closes with advice to embrace feedback and own both accomplishments and failures. ### [Deconstructing the Monolith - Shopify](https://yomu.fyi/post/deconstructing-the-monolith-shopify.md) - Company: [Shopify](https://yomu.fyi/company/shopify.md) - Author: 2023-10-18 - Published: Feb 21, 2019 Shopify describes why its decade-old Ruby on Rails monolith became difficult to change as the codebase and development organization grew. High coupling and absent boundaries made innocuous changes trigger unrelated test failures, slowed CI, and forced developers to absorb excessive domain context, while microservices would add deployment, infrastructure, network, and coordination costs. The chosen path was a modular monolith: retain one codebase and deployment unit while separating domains through strictly enforced component boundaries. Shopify’s Componentization effort was informed by a developer survey and uses Wedge to score components and report violations, including cross-component associations and calls that bypass explicitly public interfaces. Boundary enforcement at runtime remains a future goal, but dependency isolation has already enabled replacing a legacy tax engine with a new tax calculation system. ### [Unifying Our GraphQL Design Patterns and Best Practices with Tutorials](https://yomu.fyi/post/unifying-our-graphql-design-patterns-and-best-practices-with-tutorials.md) - Company: [Shopify](https://yomu.fyi/company/shopify.md) - Author: 2023-10-18 - Published: Feb 13, 2019 Shopify describes how its GraphQL work grew from an early experiment for mobile APIs into contributions from hundreds of developers across teams and offices, including the Admin and Storefront APIs. As adoption expanded, sparse Markdown guidance left context inconsistently shared, while design guidelines were mixed with code-reference documentation and became difficult to extend for complex cases. The API Patterns Team, created in May 2017, addressed this by focusing on horizontal concerns, identifying common patterns, and documenting solutions for developers working across API domains. This work produced a living, in-depth design tutorial that explains Shopify’s GraphQL design philosophy through a practical example; its central rule is to understand the business domain and design the API to reflect it rather than the application’s implementation. [Newer posts](https://yomu.fyi/company/shopify/page/16.md)