Loading…
Shopify
Global commerce platform powering millions of businesses with essential infrastructure and innovative engineering solutions.
328 postsWebsite
Latest articles
Shopify ·
Shopify’s Bug Bounty Program Raises Maximum Payout in 2022
Shopify’s Application Security team reports on its 2021 bug bounty results and announces program changes for 2022. Effective immediately, the maximum bounty for a CVSS 10.0 issue doubles from $50,000 to $100,000, with higher High and Critical brackets, while Shopify Plus, Shop, and Shop Pay services move into the Core asset category; mobile-client-specific issues remain Non-Core. The program received more than 3,000 reports, paid over $1 million in bounties and bonuses, and saw approximately 23% of reports judged valid, up from 19% in 2020. After its first full year using CVSS-based scoring, Shopify reports more consistent decisions and a reduction in average time to bounty from 249 hours to 137, while adding a CVSS guide, more resources, and further open-source support.
2023-10-18Shopify ·
Using Terraform to Manage Infrastructure
Shopify’s Conversations team used Twilio TaskRouter to route voice and chat tasks to agents according to routing rules and skills. As routing needs grew, configuration through Twilio’s GUI became difficult to understand and lacked clear change history, tests, and rollback support. Terraform provided an infrastructure-as-code workflow, backed by a reliable API, a Go client library, and a provider implementing CRUD operations; the team built a provider because Twilio did not have one at the project’s start. Resource definitions included schemas, dependencies, and an importer, while Terraform’s plan and apply commands previewed and executed changes. Integrated with Atlantis and GitHub pull requests, the workflow added plans, reviews, revision history, and easier rollbacks, while enabling business and support teams to submit infrastructure changes themselves.
2023-10-18Shopify ·
Creating a React Library for Consistent Data Visualization
Shopify found that teams across its more than 10,000 employees used different visualization tools, producing inconsistent chart styling and differing accessibility and print behavior. The Insights team built Polaris Viz, a React library intended to provide shared, accessible defaults while reducing repeated configuration, and focused this work on light and dark themes plus consumer-defined visual identities. The library replaces numerous visual-style props with a theme prop, stores themes through PolarisVizProvider, and uses createTheme to fill partial definitions with defaults and createThemes to preserve Default and Light themes. Themes can inherit from other themes, while a DataSeries colour can override theme series colors for dataset-specific gradients without creating additional themes. Polaris Viz was subsequently released as an open-source project.
2023-10-18Shopify ·
After the Refactor: A Path to Faster Rendering with Liquid-C
Liquid-C is an extension to the Liquid gem that parses, tokenizes, and renders templates, but some Liquid features, including If and For tags, still render in Liquid rather than Liquid-C. The work explains how Liquid-C compiles templates into bytecode for a customer VM and addresses the difficulty of moving instruction and constant pointers when control flow requires forward or backward jumps. It refactors instructions to store each constant’s index in the constants array, using a hash table to avoid duplicate constants and remove the constant pointer. The change reduced one example constants array from 157 objects to 104, but did not drastically improve theme rendering speed; it slightly increased memory usage and parsing time while preparing for GOTO or JMP operations and later If and For support.
2023-10-18Shopify ·
7 Tips For Optimizing Apache Flink Applications
Shopify presents lessons from operating large, stateful Apache Flink applications on Kubernetes with Google Kubernetes Engine, RocksDB, and checkpoints and savepoints stored in Google Cloud Storage. The guidance begins with profiling tools, including async-profiler, VisualVM, jemalloc with jeprof, and Eclipse Memory Analyzer, to investigate CPU, heap, native-memory, and leak-related problems. Disabling Kryo fallback exposed unsupported serializers such as Scala BigDecimal and Scala algebraic data types; replacing them with supported alternatives increased throughput by 20 percent. The post also recommends separate configuration profiles for high-throughput backfills and low-latency steady state, while describing a RocksDB native-memory failure in which disabling the block cache stopped repeated out-of-memory crashes without affecting application performance.
2023-10-18Shopify ·
Test Budget: Time Constrained CI Feedback
Shopify’s core monolith contains more than 170,000 tests, and variable CI feedback times create delays and context switches as the test pool grows. The Test Infrastructure team evaluated a Test Budget approach that builds prioritized orders on top of deterministic test selection, then stops execution at a predetermined time to increase the chance of finding failures early while accepting some risk. Six criteria were compared—failure_rate, avg_duration, churn, coverage, complexity, and default/random—using Time to First Failure, APFD, and Convergence Index; historical results were stored and queried with Redis Sorted Sets. The analysis found failure_rate had the best detection rate, while churn and complexity were inappropriate; running 60% of the suite detected 80% of failures in the mean case, and 70% of the test-selection suite detected 50% at the fifth percentile.
2023-10-18Shopify ·
Adding the V8 CPU Profiler to v8go
v8go adds support for V8’s CPU Profiler, allowing Go users to measure JavaScript execution in a V8 isolate and inspect sampled top-down call trees with function and engine details. The API work aimed to stay idiomatic for Go, remain close to V8’s API, support future profiler features, and minimize Cgo overhead. The first design loaded profile data lazily, making separate Cgo calls for profile and node properties; the alternative built the complete graph in C++ before returning it to Go. Benchmarks showed lazy loading was faster for a small tree, averaging about 20 microseconds versus 25 for eager loading, while a larger tree reversed the result at roughly 90 versus 60 microseconds. The comparison demonstrates that Cgo costs depend on workload size and that performance assumptions require benchmarks using representative inputs.
2023-10-18Shopify ·
RubyConf 2021: The Talks You Might Have Missed
RubyConf 2021: The Talks You Might Have Missed compiles talks presented by Shopify’s Ruby and Rails infrastructure engineers at the November conference in Denver, offering ways to revisit sessions for attendees who missed them. The program covers Ruby implementation topics including compiler history, Aaron Patterson’s pure-Ruby JIT compiler, YJIT’s incremental integration inside CRuby, parser generators, variable-width allocation, and Ruby memory layout. Other sessions address gradual Sorbet adoption, native extension compilation and security, pair programming, memoization performance, executable code as data, Ruby archaeology, fast CI, and Ractor-based parallel testing. The roundup reports early YJIT performance results, describes a CI environment with 2.8 million Rails monolith lines and 210,000 Ruby tests, and notes variable-width allocation passed Shopify’s Rails CI while serving more than 500 million requests in a week of limited production traffic.
2023-10-18Shopify ·
Changing a polymorphic_type in Rails
Rails normally persists a polymorphic association’s type as the parent class name, so moving Car under Garage changes stored values from “Car” to “Garage::Car” and can break lookups for older Key records. The post presents an alternative for the Vehicle/Key example: override polymorphic_name so Garage::Car and Garage::Boat resolve to stable arbitrary strings such as “car” and “boat,” reducing coupling between namespaces and database data. During transition, the association scope must explicitly accept both legacy class-name values and new arbitrary values, because Rails uses only the single value returned by polymorphic_name when querying; existing rows can then be cleaned up with a migration, script, or MaintenanceTasks. After cleanup, the temporary unscope can be removed, while class and module renames require updating the mappings rather than database records. The approach adds complexity and is presented as worthwhile only when near-term naming changes are likely.
2023-10-18Shopify ·
How to Get an Engineering Internship at Shopify: A Complete Guide
Shopify’s guide describes its engineering internship program as a way for students, recent graduates, career switchers, and bootcamp graduates to gain hands-on experience through real projects and practical feedback. Internships last three to eight months and span front-end, back-end, infrastructure, data, and mobile development, with three application cycles each year. Applicants submit an online application, complete an Intern Challenge or specialization-specific skills assessment, and progress through a two-phase interview involving a Life Story conversation and a technical solution. The guide identifies collaboration, lifelong learning, curiosity, GitHub experience, remote-work experience, communication, and accountability as important skills, while recommending practice challenges, project portfolios, and company research; 98% of respondents in Shopify’s latest intern satisfaction survey said they would recommend the program.
2023-10-18Shopify ·
Hydrogen & Tailwind: The Perfect Match for Building Beautiful Storefronts
Hydrogen uses Tailwind as the default styling option in its React-based starter, allowing developers to build storefronts with utility classes from the moment they run create-hydrogen-app. The article presents componentization as a central way to organize those classes: React components can encapsulate responsive, hover, flexbox, spacing, typography, and visibility utilities and be reused across a storefront. It contrasts this with semantic class systems whose names can become coupled to a product component, making reuse, renaming, or duplication more cumbersome. Tailwind’s learning curve still requires CSS knowledge, but its documentation and VS Code extension support autocomplete, style representations, and color previews. The conclusion is that Tailwind’s constraints, customizable design system, and composable styles complement Hydrogen’s starter components and developer experience, although the author acknowledges that readers may still prefer other approaches.
2023-10-18Shopify ·
Shopify's Playbook for Scaling Machine Learning
Shopify describes how its machine-learning practice grew from a first order-fraud product into a portfolio used across products such as Shopify Capital, product categorization, and Help Center search. The playbook starts with choosing a user-important problem, validating trustworthy and accessible data, tracing downstream dependencies, understanding existing solutions, and optimizing for product outcomes rather than model scores alone. To productionize models, Shopify recommends well-defined training, verification, and testing pipelines, deployment decisions based on volume and user commitment, and platform practices that encode validated standards without abstracting too early. Its fraud pipeline builds models in Python, serializes them with PMML for deployment in Ruby-based production systems, and uses Apache Airflow to schedule operations. The account concludes that scaling is a full-stack problem requiring data scientists and data engineers to align on one roadmap and goal.
2023-10-18Shopify ·
React Server Components Best Practices You Can Use with Hydrogen
React Server Components (RSC) introduced a paradigm shift for the team building Hydrogen, a React-based framework for custom storefronts. The post presents patterns developed through trial and error, beginning with shared components as a middle ground and reserving client components for interactivity, useState or useReducer, lifecycle logic, unsupported libraries, or browser APIs. Components should instead become server components when they contain secrets or proprietary logic, need filesystem or database access, fetch storefront API data, or do not execute on the client. The examples extract newsletter form controls and FAQ accordion behavior into client components, then rename the remaining wrappers as server components when their usage allows it; the FAQ server component is passed through a client component as children.
2023-10-18Shopify ·
Rapid Development with Hydrogen: Building a Product Page
Updated for Hydrogen 0.26.0, the tutorial builds a simple product page for a custom Shopify storefront using Hydrogen’s React-based framework. Starting from the Hello World template on StackBlitz, it adds Tailwind CSS, creates a file-based dynamic product route, and queries product data through the Storefront API with the useShopQuery hook. The implementation then uses React Server Components alongside a client component and ProductOptionsProvider to track selected variants and options, update prices, and support a BuyNowButton checkout flow. A media gallery and additional styling complete the page, which uses products and media from the Hydrogen Preview store. The post concludes that Hydrogen’s components, hooks, and utilities reduce repetitive storefront work and speed development.
2023-10-18Shopify ·
Fixing the Dependency Confusion Vulnerability in 600+ Ruby Apps - Shopify
Shopify identified a dependency confusion vulnerability through its bug bounty program; an attacker could exploit ambiguous package sources to install a malicious dependency and gain access to local, CI/CD, and production environments. To assess exposure, the Ruby Conventions team collected Bundler versions from repositories in a data lake and found around 600 susceptible Ruby applications. An experimental Bundler plugin converted Gemfile.lock files to the explicit-source format while restoring existing gem versions, and a CI-backed CLI later provided per-repository environments, parallel execution, pull requests, and easier failure tracking. After incremental migrations exposed configuration and tooling issues, Shopify updated supporting systems, set Bundler requirements, changed local and CI defaults, and worked with Bundler maintainers; the company reports migrating all its applications in less than a day and contributing to Bundler 2.2.21 and 2.2.22.
2023-10-18Shopify ·
Cloud, Load, and Modular Code: What 2022 Looks Like for Shopify
Shopify’s 2021 BFCM four-day event exposed the scale its commerce platform must absorb: peak app-server traffic exceeded 32 million requests per minute, load balancers surpassed 34 million RPM, and a flash sale used more than 20% of total computing capacity. The post frames larger, spikier sales, mobile and social commerce, and expanding buying environments as enduring engineering challenges for supporting millions of merchants. Planned work includes evolving the large Rails codebase into modular components, moving storefront rendering out of the monolith, expanding Spin cloud development environments, and making in-house load testing part of product development. The storefront split and refactoring produced four-times-faster cache fill rates and five-times-faster page rendering, while YJIT ran 31% faster than interpreted CRuby and 26% faster than MJIT; Shopify also remains committed to Rails and React Native.
2023-10-18Shopify ·
Search at Shopify—Range in Data and Engineering is the Future
Search at Shopify is presented as a case for range across data science and engineering, rather than narrow specialization in either discipline. The article describes a team that treats work as “search” instead of separating data and engineering responsibilities: engineers learn experimentation and model evaluation, while data scientists build performant, testable, maintainable production systems. It frames search as a sequence of trade-offs among relevance, correctness, scalability, performance, stability, and maintainability, arguing that people who understand only half the constraints can produce siloed handoffs, deployment delays, or suboptimal systems. Shopify’s stated model is a single collaborative team with shared planning and execution, intended to reduce territorial boundaries and support smart, fast, scalable search. The article extends this principle to personalized and conversational products, concluding that future work will require practitioners to move between data and engineering.
2023-10-18Shopify ·
That Old Certificate Expired and Started an Outage. This is What Happened Next
On September 30th, 2021, Shopify nearly suffered a platform-wide outage after Let’s Encrypt’s old root certificate expired, exposing stale certificate data in internal clients rather than at the public edge. At 10:15 a.m., monitoring detected certificate errors after deployment-related connection changes, and investigation traced them to Ruby services that depended directly or indirectly on httpclient, whose embedded cacert.pem was six years old and did not trust the applicable certificate chain. Shopify forked the library, replaced cacert.pem with a current root certificate bundle, deployed it to canaries, and automated pull requests for affected repositories. The temporary fix restored the monolith, while systems were added to track root-certificate changes and update the fork automatically. Deployment locking kept most monolith pods from cycling, limiting the incident to canaries and causing secondary effects including delayed order confirmations, throttled marketing campaigns, and missing product recommendations.
2023-10-18Shopify ·
Nerd Out on 10 of Our Favorite Posts From 2021
Shopify’s year-end roundup curates ten favorite engineering posts from 2021, spanning Ruby, storefronts, data analysis, databases, search, GraphQL, CI, APIs, and mobile development, while also noting several older reader favorites. The selection includes tutorials on building a web app with standard Ruby libraries, exploratory data analysis, GraphQL, Apache Beam for search, and React Native App Clips, alongside technical accounts of Hydrogen, YJIT, MySQL upgrades, and GraphQL rate limiting. YJIT was merged upstream and included in Ruby 3.1.0, while the CI team reduced the p95 of Shopify’s core monolith from 45 minutes to 18 minutes. The roundup also describes query-cost-based GraphQL rate limiting, rollback-testing roadblocks during a MySQL upgrade, and an App Clip effort that used a fail-fast, iterative approach.
2023-10-18Shopify ·
Shopify’s Unique Data Science Hierarchy Of Needs
Shopify presents a five-level Data Science Hierarchy of Needs that organizes data work by the value it delivers, rather than by technical sophistication. Its tool-agnostic philosophy favors simple solutions first, then more complex analysis when necessary, with impact and better decisions as the goal. The model begins with collecting and modeling clean, conformed data using dimensional modeling, then moves through description, prediction and inference, prescription, and influence. Shopify applied this structure to a COVID-19 impact analysis, using statistical analysis to examine regional effects and inform measures including an extended free trial, expanded funding, shipping options, and local commerce features. The account says the analysis used neither artificial intelligence nor machine learning, yet supported decisions for merchants and Shopify during the pandemic.
2023-10-18