Shopify · Report #98819
S3 Buckets open to the world thanks to 'Authenticated Users' ACL
Validstatus
$1,000bounty
14upvotes
23 Feb 2016disclosed
Summary
Some of Shopify's Amazon S3 buckets were inadvertently left with "Any Authenticated AWS User" read or write permissions, allowing users outside of Shopify to access the buckets. The excess permissions have been removed.
How it was found
The write-up for this report has not been downloaded yet, or the program disclosed it without one. Read it on HackerOne.