# Shopify: bug bounty program on HackerOne

> Shopify is a bug bounty program on HackerOne. Its critical reports have paid an average of $102,055 across 41 reports (HackerOne figures, November 7, 2026). It received 1,893 reports in the 90 days to November 7, 2026, about 36 per in-scope asset.

- **Company:** Shopify
- **Platform:** HackerOne
- **Program page:** https://hackerone.com/shopify
- **Pays bounties:** yes
- **Submissions:** open
- **Launched:** April 9, 2015
- **BugRater grade:** not graded yet (fewer than three reviewers)
- **BugRater page:** https://bugrater.com/programs/shopify

## Payouts and volume

HackerOne's own published figures, captured November 7, 2026.

| Severity | Average bounty | Reports behind the average |
|---|---|---|
| Critical | $102,055 | 41 |
| High | $24,100 | 138 |
| Medium | $3,038 | 917 |
| Low | $506 | 545 |

- Reports received in the last 90 days: 1,893 (about 36 per in-scope asset)
- Bounties paid in the last 90 days: $743,663
- Bounties paid in total: $10,222,216
- Researchers participating: 1,196
- Response efficiency: 43%
- First-response target: 1 day
- Triage target: 2 days
- Bounty target: 7 days

## Scope

As imported from HackerOne on November 6, 2026: 52 assets in scope (48 bounty-eligible), 22 out of scope. The policy page is the authority.

- `*.pci.shopifyinc.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.shopify.com` (WILDCARD): in scope, bounty-eligible, max severity medium
- `*.shopify.io` (WILDCARD): in scope, bounty-eligible, max severity medium
- `*.shopifycloud.com` (WILDCARD): in scope, bounty-eligible, max severity medium
- `*.shopifycs.com` (WILDCARD): in scope, bounty-eligible, max severity critical
- `*.shopifykloud.com` (WILDCARD): in scope, bounty-eligible, max severity medium
- `accounts.shopify.com` (URL): in scope, bounty-eligible, max severity critical
- `admin.shopify.com` (URL): in scope, bounty-eligible, max severity critical
- `apps.shopify.com` (URL): in scope, bounty-eligible, max severity medium
- `arrive-server.shopifycloud.com` (URL): in scope, bounty-eligible, max severity critical
- `Authentication & ATO` (OTHER): in scope, bounty-eligible, max severity critical
- `com.jadedlabs.frenzy` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity medium
- `com.jadedpixel.pos` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity medium
- `com.jadedpixel.shopify` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity medium
- `com.shopify.arrive` (APPLE_STORE_APP_ID): in scope, bounty-eligible, max severity medium
- `com.shopify.mobile` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity medium
- `com.shopify.pos` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity medium
- `com.shopify.pos.customerview` (GOOGLE_PLAY_APP_ID): in scope, bounty-eligible, max severity medium
- `exchangemarketplace.com` (URL): in scope, bounty-eligible, max severity medium
- `experts.shopify.com` (URL): in scope, bounty-eligible, max severity medium
- `flow.shopifycloud.com` (URL): in scope, bounty-eligible, max severity medium
- `google-shopping.shopifycloud.com` (URL): in scope, bounty-eligible, max severity medium
- `Handshake Marketplace` (OTHER): in scope, bounty-eligible, max severity medium
- `Hosts List` (OTHER): in scope, bounty-eligible, max severity medium
- `https://apps.shopify.com/advanced-cash-on-delivery` (URL): in scope, bounty-eligible, max severity medium
- `https://apps.shopify.com/apple-business-chat` (URL): in scope, bounty-eligible, max severity medium
- `https://apps.shopify.com/digital-downloads` (URL): in scope, bounty-eligible, max severity medium
- `https://apps.shopify.com/product-reviews` (URL): in scope, bounty-eligible, max severity medium
- `https://apps.shopify.com/shopify-widgets` (URL): in scope, bounty-eligible, max severity medium
- `https://exchangemarketplace.com/` (URL): in scope, bounty-eligible, max severity medium
- `https://github.com/Shopify/*` (SOURCE_CODE): in scope, bounty-eligible, max severity medium
- `instagram-commerce.shopifycloud.com` (URL): in scope, bounty-eligible, max severity medium
- `linkpop.com` (URL): in scope, bounty-eligible, max severity medium
- `messenger-commerce.shopifycloud.com` (URL): in scope, bounty-eligible, max severity medium
- `partners.shopify.com` (URL): in scope, bounty-eligible, max severity critical
- `Plus Web Admin with Single Domain Feature` (OTHER): in scope, bounty-eligible, max severity critical
- `sell-on-amazon.shopifycloud.com` (URL): in scope, bounty-eligible, max severity medium
- `shop.app` (URL): in scope, bounty-eligible, max severity critical
- `Shopify Developed Apps` (OTHER): in scope, bounty-eligible, max severity medium
- `Shopify Mobile Applications` (OTHER): in scope, bounty-eligible, max severity critical
- and 34 more on the BugRater page

## What researchers say on BugRater

- Would submit again: 100%
- Average rating: 4 of 5

**Hacktivity: Shopify (50 disclosed)** (An anonymous researcher, October 1, 2026, 4 of 5)

Source: HackerOne Hacktivity (public disclosures) Program: https://hackerone.com/shopify Disclosed reports analyzed: 50 Bounties: $2,062 avg, $9,400 range, $43,300 total (21 paid) --- Aggregated from publicly disclosed HackerOne reports. Ratings derived from triage timing and bounty data.

## Recent public accepted findings

- November 3, 2026: medium severity, awarded $3,100
- July 3, 2026: none severity
- June 18, 2026: medium severity, awarded $1,600
- June 1, 2026: none severity
- April 24, 2026: none severity

---

Generated November 7, 2026 from BugRater data. Platform figures are the platform's own; grades and reviews are BugRater's. Agents can check targets against this scope with the check_scope tool at https://bugrater.com/mcp.