Shopify Engineering

@icmlconf What we're bringing →ta-conference.myshopify.com/pages/shopify-…

🇰🇷 For our Spring Editions launch, we shared how we cluster billions of products for agentic commerce. That's one AI/ML team. At @icmlconf in Seoul in 3 weeks we're bringing them all: search, recommendations, Sidekick, SimGym, Flow, ads, financial services, the global product catalog, and the platform underneath. Real problems, real scale. Come talk to the devs doing the building at Booth B306.

So many new Catalog API features to explore in our latest Edition: #agentic" target="_blank" rel="nofollow noopener">shopify.com/editions/sprin…

Our Catalog API got some big upgrades in @Shopify’s Spring 2026 Edition today. On our Eng Blog, we share one of the hard problems we solved that makes the Catalog API so powerful: building an LLM pipeline to cluster billions of products across millions of stores into a unified catalog for agentic commerce. ↓

Expo Demo: Tangent: Autonomous Auto-Research Agent for ML Pipelines icml.cc/virtual/2026/7…

Expo Workshop: The Generative Turn in Search and Recommendation: Foundations, Scale, and Frontiers icml.cc/virtual/2026/7…

🇰🇷 Here’s what’s on deck for us @icmlconf in Seoul next month: Our Expo Talk on how we distill LLMs into smaller, faster, and more accurate models than their teachers. A live demo of Tangent, our autonomous ML pipeline research agent. A workshop on the generative turn in search and rec at 81M+ shopper scale. And booth presentations from every ML team at Shopify. Come see what we’re building. 👇🏻

🔍 Come join the hunt for bugs here: shopify.com/bugbounty

📊 Bug bounty surveillance log | May ’26 • 515 vulnerability reports intercepted • 229 new hackers onboarded • 41 reports awarded bounties • $26K+ distributed to hunters

Everyone's talking about AI-generated HTML. But have you tried giving your sites a zero-config API for saving data, file storage, AI, websockets, etc? We did this at Shopify. Runs on a single VM that costs $200/month, and it's changed the way we work. We call it Quick 👇🧵

Reflexive AI use @Shopify means tons of experimenting. Everyone’s a builder now. But how do you share all that work with your team? Last year, we built a hosting platform on a single VM. Usage exploded: 50,000+ sites so far. Meet Quick, our hosting tool:

Multipliers (on standard bounty): • Medium = 1.25× • High = 1.5× • Critical = 2× Hunt: auth bypass, MFA, OAuth/SSO/SAML/SCIM, session flaws, ATO, auth-API authz. Scope + surfaces: hackerone.com/shopify?type=t… Closes June 26. #bugbounty

Authentication & Account Takeover campaign is live. Three weeks. Multipliers up to 2× for criticals on auth & ATO findings ↓

Standard bounty (no multiplier): • Pre-account squatting • Customer storefront accounts (legacy) • Enumeration • Brute force w/o rate-limit bypass • Self-XSS on login • Generic bugs chained into an auth/ATO impact Live Mon. hackerone.com/shopify

Covered surfaces: • Merchant admin • Partners • accounts.shopify.com • Shop App auth + Login with Shop • Checkout auth • Admin / Storefront / app session token issuance • POS staff auth • B2B buyer auth incl. merchant SSO/SAML • 2FA recovery flows

Authentication & Account Takeover campaign launches Monday. Scope ↓