H1 HackerOne LIVE
Shopify
pays bountiesTABLE ↗
Open on HackerOne ↗
- listed
- before tracking
- tracked since
- 2026-09-20
- website
- https://www.shopify.com
- managed triage
- no
- response efficiency
- 55%
- first response
- 106h avg
- time to bounty
- 305h avg
21 targets in scope
| asset | type | bounty | max sev | seen |
|---|---|---|---|---|
accounts.shopify.com | domain | yes | critical | 2026-09-20 |
admin.shopify.com | domain | yes | critical | 2026-09-20 |
arrive-server.shopifycloud.com | domain | yes | critical | 2026-09-20 |
linkpop.com | domain | yes | medium | 2026-09-20 |
partners.shopify.com | domain | yes | critical | 2026-09-20 |
shop.app | domain | yes | critical | 2026-09-20 |
shopify.plus | domain | yes | critical | 2026-09-20 |
shopifyinbox.com | domain | yes | medium | 2026-09-20 |
your-store.myshopify.com | domain | yes | critical | 2026-09-20 |
Authentication & ATO | other | yes | critical | 2026-09-20 |
Shopify Developed Apps | other | yes | medium | 2026-09-20 |
Shopify Mobile Applications | other | yes | critical | 2026-09-20 |
Shopify Third Party Apps | other | no | medium | 2026-09-20 |
Shopify Third Party Store | other | no | medium | 2026-09-20 |
https://github.com/Shopify/* | source code | yes | medium | 2026-09-20 |
*.pci.shopifyinc.com | wildcard | yes | critical | 2026-09-20 |
*.shopify.com | wildcard | yes | medium | 2026-09-20 |
*.shopify.io | wildcard | yes | medium | 2026-09-20 |
*.shopifycloud.com | wildcard | yes | medium | 2026-09-20 |
*.shopifycs.com | wildcard | yes | critical | 2026-09-20 |
*.shopifykloud.com | wildcard | yes | medium | 2026-09-20 |
9 out of scope — black ICE, don't touch
academy.shopify.comdomaincdn.shopify.comdomaincommunity.shopify.comdomaincommunity.shopify.devdomaininvestors.shopify.comdomainlivechat.shopify.comdomainOtherothersupplier-portal.shopifycloud.comother*.email.shopify.comwildcard
Change log
get alerts ↗No changes since we started tracking on 2026-09-20.