Shopify Exchange screenshot service crossed internal boundaries
Shopify awarded USD 25,000 for a screenshot-service request-isolation flaw with impact bounded to one infrastructure subset.
USD 25,000reported awardRead
RQVulnerability family
Server-side request trust.
Destination validation and boundaries in server-initiated requests. 1 disclosures · 1 related references · 1 diagrams.
Connected collection
Disclosures
Connected collection
Related learning
OWASP Server-Side Request Forgery Prevention
Explains destination validation and network isolation for server-initiated requests, distinguishing fixed trusted destinations from services that need broader external access.
Reviewed 2026-10-02Read
Connected collection
Visual models
Layer server-request destination controls
Original conceptual defense-in-depth model linked to the historical Shopify Exchange case and OWASP guidance. It is not a vendor architecture diagram. Policy must fit the service’s destination requirements.
Reviewed 2026-10-02Read
Related learning follows the topic crosswalk or an explicit diagram relationship. It does not classify a resource as a finding. Topics overlap, so their counts should not be added together.
GitHub snapshot 2026-10-04
53796974ace8 · JSON exports & schemas · CC BY 4.0 content / MIT software