Shopify · Report #92344
customers password hash leak!!!!
Validstatus
$500bounty
4upvotes
5 Oct 2015disclosed
Summary
An endpoint in the Draft Order feature would return a serialized version of the Customer that contained the account password (hashed and salted) as well as the last password reset token (when available).
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.