Re:Shopify has paid over $300k in security exploit bounties
by breuvertje on Saturday December 17, 2016 @08:04AM
(#13200548)
This bug bounty program was limited to MRuby and paid by Shopify. Does anyone know where they use MRuby in their stack?
[ Parent
| on HN ]
Re:Shopify has paid over $300k in security exploit bounties
by allover on Saturday December 17, 2016 @08:12AM
(#13200571)
From [1]:
>> The Script Editor app lets you create scripts that are run each time a customer adds items to their cart. Shopify Scripts can have many uses, from discounting products with specific tags to running promotions such as "buy 2, get 1 free". Shopify Scripts are written with a Ruby API that allows a great deal of control and flexibility.
The description on the bug bounty page says those 'Shopify Scripts' are executed in an MRuby environment, which they are trying to keep sandboxed.