---
title: "Bug Bounty Year in Review 2018"
description: "Shopify’s 2018 bug bounty review reports its fifth year and most successful program to date, with faster handling and higher payouts. The security team cut average triage time from four days in 2017 to 10 hours in 2018 by assigning one of its 14 Application Security members to HackerOne triage each week. At Montreal’s H1-514 event, over 40 hackers produced more than 50 valid reports, supported by early submissions, disclosed resolved reports, incentive bonuses, expanded scope, and infrastructure shell access. Excluding event statistics, average bounty rose to $1,790, total payouts reached $155,750, 60% of resolved reports received a bounty, and triage, bounty, and resolution times improved, although resolved reports and participating hackers declined and some low-severity reports exceeded the one-month target."
---

# Bug Bounty Year in Review 2018

[Shopify](https://yomu.fyi/company/shopify) · peter yaworski · Dec 20, 2018

**Type:** Benchmark

## Summary

Shopify’s 2018 bug bounty review reports its fifth year and most successful program to date, with faster handling and higher payouts. The security team cut average triage time from four days in 2017 to 10 hours in 2018 by assigning one of its 14 Application Security members to HackerOne triage each week. At Montreal’s H1-514 event, over 40 hackers produced more than 50 valid reports, supported by early submissions, disclosed resolved reports, incentive bonuses, expanded scope, and infrastructure shell access. Excluding event statistics, average bounty rose to $1,790, total payouts reached $155,750, 60% of resolved reports received a bounty, and triage, bounty, and resolution times improved, although resolved reports and participating hackers declined and some low-severity reports exceeded the one-month target.

## Context

The review covers Shopify’s fifth year running a bug bounty program and third year using HackerOne. It compares 2018 operational metrics, payouts, report outcomes, disclosures, and the H1-514 live hacking event with 2017 results.

## Approach / What changed

Shopify assigned one Application Security team member each week as the primary HackerOne triager, while retaining broader queue coverage. Reports were validated according to severity, with critical issues replicated and escalated to the on-call team, high-severity issues reviewed with development teams, and medium- or low-severity issues checked against code, open issues, and pull requests. The program also used early event submissions, disclosure of resolved reports, targeted bonuses, expanded scope, and infrastructure shell access.

## Takeaways

- A dedicated weekly triager reduced average HackerOne triage time from four days in 2017 to 10 hours in 2018, despite receiving largely the same report volume.
- H1-514 accepted submissions when the target was announced, disclosed resolved reports during the event, and used bonuses for areas such as GraphQL, race conditions, regressions, and the oldest bug.
- Excluding H1-514, Shopify paid $155,750 in 2018, with an average bounty of $1,790 and 60% of resolved reports receiving a bounty; five five-figure bounties were awarded.

## FAQ

### How did Shopify reduce its average triage time to 10 hours?

One of the 14 Application Security team members became the dedicated HackerOne triager each week, making report handling their primary responsibility. Other team members could still monitor the queue and pick up reports.

### What made the H1-514 event different from Shopify’s regular bounty program?

Shopify opened submissions when the target was announced, disclosed resolved reports during the event, offered bonuses for creative work, expanded the program’s scope, and gave hackers infrastructure shell access. The event received more than 50 valid vulnerability reports from over 40 hackers.

### How were critical and high-severity reports handled?

Critical reports were replicated, confirmed, escalated to the responsible on-call team, and triaged on HackerOne. High-severity reports were replicated, sent to the responsible development team, reviewed collaboratively for novelty, and then triaged.

**Tags:** [HackerOne](https://yomu.fyi/topic/hackerone), [Security](https://yomu.fyi/topic/security)

- Source: [Shopify](https://shopify.engineering/shopify-bug-bounty-year-in-review-2018)
- Source URL: https://shopify.engineering/shopify-bug-bounty-year-in-review-2018
- Ingested by Yomu: 2026-09-17T14:06:24.264Z

[Read original post](https://shopify.engineering/shopify-bug-bounty-year-in-review-2018)