Browse / Shopify

Shopify

See its reports on the map

Attack surface: 27,668 known subdomains

Not every host here is in scope. Check the program's policy before testing. Last updated 2026-11-13.

What gets reported to Shopify

• Cross-site Scripting128
• Access Control99
• Authentication70
• Information Disclosure48
• Misconfiguration25
• Open Redirect19

Most upvoted reports

AllValidInformativeN/ADuplicate

1. admin.shopify.com: Shopify Flow continues sending internal emails to a configured recipient after the staff author is removedInformative
   78 votes
2. Exposure of shopify employee summit page allows anonymous user to place orders for free booksInformativeBusiness Logic Errors
   76 votes
3. Session Persistence Designed to Keep Users Logged In Across Multiple Devices (Intended Behaviour)InformativeSession Fixation
   63 votes
4. mruby-engine: UAF in MRubyEngine#initialize enables local RCEInformativeCode Injection
   35 votes
5. GraphQL Introspection Enabled on Shopify API Endpoint (Intended Behavior)InformativeInformation Disclosure
   28 votes
6. Missing HMAC validation on /uninstall webhook in Shopify/sample-django-app reference templateInformativeImproper Verification of Cryptographic Signature
   18 votes
7. XSS - URL RedirectsInformativeCross-site Scripting (XSS) - Generic
   4 votes
8. The POS Firmware is leaking the root Password which can be used for unauthorized access to the device.InformativeImproper Authentication - Generic
   3 votes
9. Multiple issues on Checkout ProcessInformativeViolation of Secure Design Principles
   3 votes
10. Lack of SSL Pinning on POS Application ( iOS )InformativeCryptographic Issues - Generic
    3 votes