Shopify · Report #95441
Unauthorized access to any Store Admin's First & Last name
Validstatus
4upvotes
7 Nov 2015disclosed
Summary
This issue allowed unauthenticated users to access personally identifiable information of the store's staff members (first and last name) via a public api endpoint.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.