shopify

HackerOneView on HackerOne
RawAI Enhanced
20
In Scope
9
Out of Scope
In-Scope Assets (20)
AssetCategoryBountyQuick Links
*.pci.shopifyinc.comWILDCARDYes
*.shopify.comWILDCARDYes
*.shopify.ioWILDCARDYes
*.shopifycloud.comWILDCARDYes
*.shopifycs.comWILDCARDYes
*.shopifykloud.comWILDCARDYes
Shopify Developed AppsOTHERYes-
Shopify Mobile ApplicationsOTHERYes-
Shopify Third Party AppsOTHERNo-
Shopify Third Party StoreOTHERNo-
accounts.shopify.comURLYes
admin.shopify.comURLYes
arrive-server.shopifycloud.comURLYes
https://github.com/Shopify/*CODEYes-
linkpop.comURLYes
partners.shopify.comURLYes
shop.appURLYes
shopify.plusURLYes
shopifyinbox.comURLYes
your-store.myshopify.comURLYes
Out-of-Scope Assets (9)
AssetCategoryBounty
*.email.shopify.comWILDCARDNo
OtherOTHERNo
academy.shopify.comURLNo
cdn.shopify.comURLNo
community.shopify.comURLNo
community.shopify.devURLNo
investors.shopify.comURLNo
livechat.shopify.comURLNo
supplier-portal.shopifycloud.comOTHERNo
Scope Changes (92)
Feb 25, 2026
ChangeAssetCategoryScopeTime
Addedcommunity.shopify.devURLOut of Scope19:09
Addedadmin.shopify.comURLIn Scope19:09
Addedshopifyinbox.comURLIn Scope19:09
Added*.shopify.comWILDCARDIn Scope19:09
Added*.shopifycloud.comWILDCARDIn Scope19:09
Addedlivechat.shopify.comURLOut of Scope19:09
Addedcommunity.shopify.comURLOut of Scope19:09
Addedpartners.shopify.comURLIn Scope19:09
Added*.shopifycs.comWILDCARDIn Scope19:09
Addedshop.appURLIn Scope19:09
Addedshopify.plusURLIn Scope19:09
Addedinvestors.shopify.comURLOut of Scope19:09
Addedshopify third party appsOTHERIn Scope19:09
Addedshopify third party storeOTHERIn Scope19:09
AddedotherOTHEROut of Scope19:09
Addedaccounts.shopify.comURLIn Scope19:09
Addedhttps://github.com/Shopify/*CODEIn Scope19:09
Addedlinkpop.comURLIn Scope19:09
Addedcdn.shopify.comURLOut of Scope19:09
Addedshopify developed appsOTHERIn Scope19:09
Addedshopify mobile applicationsANDROIDIn Scope19:09
Addedshopify mobile applicationsANDROIDIn Scope19:09
Addedyour-store.myshopify.comURLIn Scope19:09
Added*.shopifykloud.comWILDCARDIn Scope19:09
Added*.pci.shopifyinc.comWILDCARDIn Scope19:09
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope19:09
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope19:09
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope19:09
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope19:09
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope19:09
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope19:09
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope19:09
Addedacademy.shopify.comURLOut of Scope19:09
Addedarrive-server.shopifycloud.comURLIn Scope19:09
Added*.shopify.ioWILDCARDIn Scope19:09
Added*.email.shopify.comWILDCARDOut of Scope19:09
Feb 22, 2026
ChangeAssetCategoryScopeTime
Added*.shopify.comWILDCARDIn Scope00:40
Added*.pci.shopifyinc.comWILDCARDIn Scope00:40
Added*.shopify.ioWILDCARDIn Scope00:40
Addedaccounts.shopify.comURLIn Scope00:40
Addedcommunity.shopify.devURLOut of Scope00:40
Addedshopify mobile applicationsANDROIDIn Scope00:40
Addedshopify mobile applicationsANDROIDIn Scope00:40
Addedlivechat.shopify.comURLOut of Scope00:40
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope00:40
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope00:40
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope00:40
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope00:40
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope00:40
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope00:40
Addedsupplier-portal.shopifycloud.comOTHEROut of Scope00:40
Addedyour-store.myshopify.comURLIn Scope00:40
Addedpartners.shopify.comURLIn Scope00:40
Added*.shopifycs.comWILDCARDIn Scope00:40
Addedshopify third party storeOTHERIn Scope00:40
Addedshopifyinbox.comURLIn Scope00:40
Addedinvestors.shopify.comURLOut of Scope00:40
Addedshopify developed appsURLIn Scope00:40
Added*.shopifykloud.comWILDCARDIn Scope00:40
AddedotherOTHEROut of Scope00:40
Added*.email.shopify.comWILDCARDOut of Scope00:40
Addedcommunity.shopify.comURLOut of Scope00:40
Addedhttps://github.com/Shopify/*URLIn Scope00:40
Addedarrive-server.shopifycloud.comURLIn Scope00:40
Addedcdn.shopify.comURLOut of Scope00:40
Addedacademy.shopify.comURLOut of Scope00:40
Addedadmin.shopify.comURLIn Scope00:40
Addedshopify third party appsOTHERIn Scope00:40
Addedshop.appURLIn Scope00:40
Addedshopify.plusURLIn Scope00:40
Added*.shopifycloud.comWILDCARDIn Scope00:40
Addedlinkpop.comURLIn Scope00:40
Feb 21, 2026
ChangeAssetCategoryScopeTime
Removed*.shopify.comWILDCARDIn Scope21:38
Removedshopify developed appsOTHERIn Scope21:38
Removedshopify mobile applicationsOTHERIn Scope21:38
Removedyour-store.myshopify.comURLIn Scope21:38
Removedpartners.shopify.comURLIn Scope21:38
Removedaccounts.shopify.comURLIn Scope21:38
Removedadmin.shopify.comURLIn Scope21:38
Removed*.shopifykloud.comWILDCARDIn Scope21:38
Removedhttps://github.com/Shopify/*CODEIn Scope21:38
Removed*.shopifycs.comWILDCARDIn Scope21:38
Removed*.shopifycloud.comWILDCARDIn Scope21:38
Removed*.pci.shopifyinc.comWILDCARDIn Scope21:38
Removedlinkpop.comURLIn Scope21:38
Removedshopifyinbox.comURLIn Scope21:38
Removedshop.appURLIn Scope21:38
Removedshopify.plusURLIn Scope21:38
Removedarrive-server.shopifycloud.comURLIn Scope21:38
Removed*.shopify.ioWILDCARDIn Scope21:38
Addedshopify third party appsOTHERIn Scope19:11
Addedshopify third party storeOTHERIn Scope19:11