Exposure of shopify employee summit page allows anonymous user to place orders for free books

Summary

Shopify created a book shop for use at specific Shopify events. The shop was set up for testing with placeholder prices of $0 and was password protected except during testing and for Shopify events. After testing, the password was enabled or disabled to indicate whether or not the shop was currently open for orders from event attendees.

This report describes finding the shop when the password was disabled during testing and the reporter was able to place orders for books that appeared to be free.

Shopify closed this report as informative because there was no risk that orders placed by someone for free books would have been fulfilled. The key factors that informed this decision are:

1. The shop was intended to be publicly available for periods of time.
2. Because Shopify had a process in place to manually verify orders prior to submitting them to the book vendor, any orders that were placed by the public or during testing, when placeholder prices were set at $0, would have been and were identified and cancelled prior to fulfillment.