Building Shopify’s Application Security Program

Summary

Shopify's application security program is designed to preserve safety while products and services scale quickly across a platform serving more than 800,000 merchants. It organizes the work around scaling secure applications, scaling security teams, and scaling security interactions, with a culture that treats security as a non-negotiable priority. Standardizing on Ruby on Rails and other shared technologies lets tooling go deep, while service tracking provides visibility into applications, dependencies, code, and automated dependency updates. The security organization grew from one employee into specialized teams, supplemented by penetration testing, bug bounties, and audits, while incident response remains shared across the company. At the code level, tripwires detect dangerous patterns early; Shopify renamed html_safe to dangerously_output_as_html, links flagged pull requests to XSS training, and alerts Application Security, shifting review toward automation.

Context

Shopify needed an application security program that could encourage safety at high speed, remove complexity, and support creative problem solving as its products and services expanded. Security was treated as a non-negotiable priority for a platform serving more than 800,000 merchants and their customers.

Approach / What changed

The program scales secure applications through shared technical baselines and service visibility, scales security teams through specialization and targeted external services, and scales security interactions through automated testing and repository tripwires. Shopify standardized on Ruby on Rails and other common technologies, tracked services and dependencies, embedded security responsibilities across teams, and used automated guidance and alerts for risky code patterns.

Takeaways

• Standardizing products on Ruby on Rails and shared choices for databases, routing, caching, and configuration management lets security tooling focus deeply on known technologies and gives new applications stronger defaults.
• Service tracking provides visibility into running services, dependencies, and code, including the ability to identify affected applications and automatically update dependencies when vulnerabilities are announced.
• Shopify's html_safe control renames the method, links pull requests to XSS training, and alerts Application Security, allowing automated detection and guidance to supplement human reviews.

Related reading