Shopify Engineering

.@fnthawar talks AI infrastructure, culture, and guardrails behind productivity gains with @bessemervp

Commerce data is inherently messy: inconsistent product images, descriptions in dozens of languages, millions of merchants all doing it differently. Most AI benchmarks don't capture that complexity. We partnered with @MLCommons to change that:

Insights that were once out of reach for smaller merchants are now available, fast. Full deep dive → shopify.engineering/simgym #GTC2026

SimGym now runs simulated shopping sessions by the hundreds of thousands daily—with a step-change in speed on Blackwell GPUs. We partnered with engineers from @NVIDIAAI and @vLLM_project to shape a new inference stack around real production traffic: custom FlashInfer kernels, speculative decoding, and async scheduling.

The results in production for a large GraphQL list query running breadth-first: 15x faster field-level execution, 6x less GC overhead, 4+ seconds off P50 end-to-end time. Here’s more: shopify.engineering/faster-breadth…

When we profiled large and slow GraphQL list queries at Shopify, we found I/O wasn't always the bottleneck. Frequently it was GraphQL’s conventional depth-first execution design. We tried executing breadth-first instead. It went… really well.

We're enhancing payouts for certain medium severity bugs as part of our continued commitment to our security researcher community. Our updated calculator creates a smoother progression across severity tiers, with select medium severity reports now receiving increased rewards that better reflect their value to our security program. Check out our new calculator: shopify.com/ca/bugbounty/c…

Want the details on what changed in our bug bounty calculator? Let's break it down 👇

We reworked how scope changes are scored. Scope changes are now evaluated through three separate impact metrics: Confidentiality, Integrity, and Availability, collectively called Subsequent System Impact. Instead of a single “scope change” score, we now measure the effect of a vulnerability that crosses authorization boundaries according to what it impacts. This provides a more precise assessment of downstream risk.

User Interaction scoring just got more nuanced. In addition to None, we now differentiate between Passive and Active interaction. Passive means normal user activity can trigger exploitation, while Active requires a conscious, deliberate action (such as clicking a link). This separation allows for more detailed scoring of how exploitable a vulnerability is in practice.

Attack complexity wasn't telling the whole story. Alone, it sometimes missed critical deployment details. Attack Requirements is a new metric that recognizes when a vulnerability depends on specific system conditions—like feature flags, certain account types, or unique configurations. By capturing these prerequisites, we can assess vulnerabilities more granularly and give clearer context to their real-world impact.

Two new metrics just dropped in our bug bounty calculator: Value Density and Automatable. Value Density measures the depth of impact—the amount of sensitive information or control gained from a single exploitation event. Automatable determines if an exploit can be reliably scripted across multiple targets. This helps us better capture the distinction between large, high-value bugs and those that scale broadly through automation.

How we built it & what we learned on the @Shopify Engineering Blog: shopify.engineering/generative-rec…

Our team built a generative recommender that reads the full buyer journey and predicts what comes next, based on billions of real commerce events, millions of products, and the infrastructure to learn from it in real time. Fast enough to serve at scale, nuanced enough to read between the clicks.

Have feedback? Reach us at bugbounty@shopify.com

You told us, we listened. Feedback from our researcher community has shaped the latest improvements to our bug bounty calculator. Scope and impact assessment have historically been complex areas. We heard that scope could be confusing, and that medium severity findings were sometimes under-rewarded. Relying on attack complexity alone sometimes missed important nuances—especially when deployment conditions or configurations played a key role. So we reworked the calculator: we’re moving beyond attack complexity by introducing new metrics like Attack Requirements to recognize when specific system states, permissions, or feature flags are necessary for exploitation. The calculator now also incorporates Value Density, Automatable, and more granular scoring for user interaction and subsequent system impacts. This approach delivers clearer, more precise rationale behind each assessment and ensures rewards better reflect real-world effort and discovery. We appreciate everyone who gave us feedback on this. Seriously.

Check out our FAQs: shopify.com/ca/bugbounty/f…

Got questions? bugbounty@shopify.com

We just leveled up our bug bounty calculator. We added Value Density and Automatable metrics to better reflect both the depth of impact and whether an exploit can be reliably scripted across targets. Scoring for attack requirements and user interaction is now more granular, making it easier to distinguish between different types of exploitation complexity. Now you can receive higher payouts for medium severity reports. Basically: competitive payouts, and clearer reasoning on how we got there.

Full breakdown here: shopify.com/bugbounty/reso…