Shopify Engineering

Making commerce better for everyone. Follow us for technical discussions and updates on how engineers build @Shopify.

Explore open roles:

[Shopify Engineering @ShopifyEng]

Standard bounty (no multiplier):
• Pre-account squatting
• Customer storefront accounts (legacy)
• Enumeration
• Brute force w/o rate-limit bypass
• Self-XSS on login
• Generic bugs chained into an auth/ATO impact

Live Mon. https://t.co/0XH3Kbqq8k

[Shopify Engineering @ShopifyEng]

Authentication & Account Takeover campaign launches Monday. Scope ↓

[Shopify Engineering @ShopifyEng]

Covered surfaces:
• Merchant admin
• Partners
• https://t.co/TPKEOUROgA
• Shop App auth + Login with Shop
• Checkout auth
• Admin / Storefront / app session token issuance
• POS staff auth
• B2B buyer auth incl. merchant SSO/SAML
• 2FA recovery flows

[Shopify Engineering @ShopifyEng]

Full scope + covered surfaces drop Thursday June 4. Live Monday June 8.
https://t.co/fnEi9cBnCb #bugbounty

[Shopify Engineering @ShopifyEng]

Authentication & Account Takeover campaign on our bug bounty program. June 8 through June 26. Multipliers on auth & ATO findings, up to 2× for criticals ↓

[Shopify Engineering @ShopifyEng]

Multipliers on standard bounty for auth & ATO findings:
• Medium = 1.25×
• High = 1.5×
• Critical = 2×

Open to any researcher on our HackerOne. No cohort, no invite list.

[Shopify Engineering @ShopifyEng]

https://t.co/26CiLPZngw

[Shopify Engineering @ShopifyEng]

Recently @tobi shared the philosophy behind River, our Slack-native AI agent, and how it has become a teaching workshop for all of @Shopify.

Below River lies the Aquifer. Principal Engineers @burkelibbey & Javier Moreno share the engineering story of how River came to be, and the substrate it runs on:

[Google Cloud @googlecloud]

⚡ @Shopify is running sub-agents in parallel to analyze complex data over a long horizon for more accurate merchant growth forecasts at a global scale.

[Shopify Engineering @ShopifyEng]

(@MySQL for the win)
https://t.co/Z59Rm6BGD6

[Shopify Engineering @ShopifyEng]

Sometimes the most unobvious-but-correct architecture decision is just... using your primary database.

We tried it on one of our highest-stakes checkout paths, at BFCM scale. Here's how it went:

[Shopify Engineering @ShopifyEng]

🔍 Come join the hunt for bugs here: https://t.co/fyTRZHIdn0

[Shopify Engineering @ShopifyEng]

📊 Bug bounty surveillance log | April '26
• 547 vulnerability reports intercepted
• 232 new hackers onboarded
• 42 reports awarded bounties
• $180K+ distributed to hunters

[Shopify Engineering @ShopifyEng]

Read more on our Eng Blog: https://t.co/QhpTgdG81Y

Or if you’re in Rio, check out @Shopify’s booth at @iclr_conf to chat about it in person!

[Shopify Engineering @ShopifyEng]

We reverse-engineered training data from thousands of merchant-created automations and fine-tuned Qwen3-32B into a tool-calling agent for Shopify Flow.

Results: 2.2x faster, 68% cheaper

The more interesting part: why we trained on Python instead of our own DSL, and what broke when benchmarks looked good but production didn't. ⬇️

[Shopify Engineering @ShopifyEng]

Find the full 3-day schedule of our booth presentations here. https://t.co/stn5j95BZd

[Shopify Engineering @ShopifyEng]

🇧🇷 Come talk shop with Shopify at ICLR 2026 in Rio starting Thursday! 🇧🇷

We're building ML that runs 10% of e-commerce — from LLM-powered agents to production retrieval systems and sim-to-real pipelines. Real problems, real scale. Redefining commerce intelligence.

Stop by Booth #202 for deep dives on:
⚡️Sidekick — agentic merchant AI with MCP tools + multi-turn reasoning
⚡️ Commerce Foundation Model — cross-domain architecture for recs, search, catalog
⚡️ Global Catalog — multimodal LLMs, 10K+ categories, 40M inferences/day
⚡️ Search Rewriting — L1 retrieval + L2 LLM re-ranking at scale
⚡️ SimGym — sim-to-real agent training for storefronts (Expo Talk 📷)
⚡️ Tangle — the open source ml experimentation platform

[Shopify Engineering @ShopifyEng]

Our SimGym Expo Talk is Saturday @ 12:45pm (room 201c) join the chat and find the recording (eventually!) here. https://t.co/4c2SAIy19I

[Shopify Engineering @ShopifyEng]

The full story of the extension @davebcn87 & @tobi open-sourced is on our Eng Blog:

https://t.co/HUT4xbCNp5

[Shopify Engineering @ShopifyEng]

Since we open-sourced pi-autoresearch, @Shopify teams have been running it on everything.

Results so far:
Unit tests: 300x faster
React component mounting: 20% faster
CI build time: 65% reduction
Made pnpm run faster

Autoresearch never stops trying things you'd never have time to try.

Repo: https://t.co/473UFWKanV