Shopifypeter yaworskiAnnouncement
Shopify’s 2017 bug bounty review reports higher payouts, four-hour average first responses, four-day triage, and changes intended to improve researcher participation. The program paid $67,550 outside the H1-415 event, with an average bounty of almost $1,100, while 121 reports were resolved and 63.1% of submissions were closed as not applicable. At H1-415, five hackers helped resolve 15 bugs for $42,000, and the program’s largest individual payout, $20,000, addressed unauthorized collaborator access caused by account-conversion logic. Shopify also acknowledges fewer resolved reports and delayed low-severity cases, then announces a $500 minimum payment at triage, clearer scope and payout guidance, a $25,000 typical maximum, and earlier access to beta functionality for eligible whitehat partner accounts.
The review covers Shopify’s bug bounty activity and performance during 2017, including payouts, report handling, the H1-415 hacking event, disclosed vulnerabilities, and program changes introduced afterward.
Shopify announced earlier payments by paying the $500 program minimum when reports are triaged, added a payout table and a $25,000 typical maximum, clarified scope and ineligible submissions, created [email protected] for program questions, and offered eligible hackers earlier beta access through whitehat partner accounts or +hackerone email addresses.
Outside H1-415, Shopify paid $67,550 in 2017, with an average bounty of almost $1,100; half of all resolved reports received a bounty.
At H1-415, five hackers helped resolve 15 bugs and received $42,000 total. Shopify also hired one attendee as a full-time Application Security Engineer.
The revised program pays its $500 minimum at triage, publishes payout guidance, clarifies scope, and offers eligible hackers access to beta functionality before global release.
Shopify’s average first response was four hours, while average triage took four days. The gap reflected validation with the appropriate development team before closing a report as informative or not applicable.
Shopify announced that it would pay the program minimum of $500 when reports were triaged. It also added a payout table so hackers could better understand expected rewards.
Eligible hackers could use a whitehat partner account to create testing shops or add +hackerone to their email address. Their stores would then be enrolled in Shopify beta tests before new functionality became globally available.
Summaries are generated from the original by a language model. Check the original before relying on it.
See the idea
An architecture view of a bug bounty program: scope, triage, validation, containment, durable fix, and payout, plus the loop that turns each report into stronger defaults.
Keep reading
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
One useful email. Unsubscribe anytime.
