Reporting a vulnerability
E-mail us at security@digismoothie.com and include:
- a description of the issue and its potential impact,
- steps to reproduce it (a proof of concept helps),
- the affected app, URL or endpoint.
We aim to acknowledge reports within 5 business days and will keep you informed as we investigate and fix the issue.
Scope
In scope are all Shopify apps published by Digismoothie and the websites and backend services that support them.
Out of scope:
- vulnerabilities in the Shopify platform itself – please report these through Shopify’s bug bounty program on HackerOne,
- Shopify stores, custom apps and integrations we build for agency clients (see Client projects below),
- denial-of-service attacks, load testing and spam,
- social engineering or phishing of our team or our merchants,
- reports without a demonstrated security impact (e.g. automated scanner output, missing headers, email SPF/DMARC configuration).
Testing guidelines
- Test only against your own Shopify development store.
- Do not access, modify or delete data that isn’t yours. If you encounter merchant or customer data, stop and let us know.
- Give us reasonable time to fix the issue before disclosing it publicly.
Client projects
The Shopify stores, custom apps and integrations we build as an agency are owned and operated by our clients, so we can’t authorize security testing of them. If you come across a vulnerability in one of these projects, please don’t test further, but do report what you’ve found to security@digismoothie.com. We’ll coordinate the fix with the client.
Recognition
We don’t run a paid bug bounty program, but we appreciate responsible reports and are happy to credit you publicly once the issue is resolved, if you’d like.
How we protect merchant data
The technical and organisational measures we apply are described in Annex 1 of our Data Processing Agreement. For how we handle personal data, see our Privacy Policy.
Security oversight
Security inquiries are overseen by Tomáš Buzek, CTO.