Shopify · Report #94502
Some S3 Buckets are world readable (and one is world writeable)
Validstatus
$500bounty
4upvotes
24 Oct 2015disclosed
Summary
The researcher reported that several s3 bucket containing the name "shopify" were world-readable. Out of the reported buckets, two belonged to us and were not intended to be public and may have contained sensitive data. We changed the bucket options to disable file listing on the affected buckets.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.