Shopify
HackerOne live webgit_repoBug bounty program on HackerOne. Official listing: https://hackerone.com/shopify. Scope and rules are controlled by the program — always verify against the official listing before testing.
Max bounty
$200K
Starts
2015-04-01
In-scope assets
15
Last updated
2026-07-06
In-scope assets
| Type | Asset | Detail |
|---|---|---|
| web | *.pci.shopifyinc.com | Environment: Core |
| web | *.shopify.com | |
| web | *.shopify.io | |
| web | *.shopifycloud.com | |
| web | *.shopifycs.com | |
| web | *.shopifykloud.com | |
| web | accounts.shopify.com | Environment: Core |
| web | admin.shopify.com | Environment: Core |
| web | arrive-server.shopifycloud.com | Environment: Core |
| web | linkpop.com | Environment: Non-core |
| web | partners.shopify.com | Environment: Core |
| web | shop.app | Environment: Core |
| web | shopify.plus | Environment: Core |
| web | shopifyinbox.com | Environment: Non-core |
| web | your-store.myshopify.com |
Watching Shopify? BountyHunt monitors every in-scope repo and tells you the moment a commit, release, or scope change lands — in the app, by webhook, or straight to your agent over MCP.
Track this program