# Making Open Source Safer for Everyone with Shopify's Bug Bounty Program

DevFeed: [Making Open Source Safer for Everyone with Shopify's Bug Bounty Program](<https://devfeed.tech/articles/making-open-source-safer-for-everyone-with-shopify-s-bug-bounty-program-1599.md>)

Original publisher: [Read original article](<https://shopify.engineering/shopify-making-open-source-safer>)

Author: Zack Deveau

Published: 2022-06-15T18:00:02Z

Content type: article

Language: en

Sources: [Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering.md>), [Shopify Engineering - Shopify Engineering](<https://devfeed.tech/sources/shopify-engineering-shopify-engineering.md>)

Topics: [Shopify](<https://devfeed.tech/topics/shopify.md>), [Application Security](<https://devfeed.tech/topics/application-security.md>), [Rails](<https://devfeed.tech/topics/rails.md>), [vulnerability](<https://devfeed.tech/topics/vulnerability.md>), [Bug Bounty](<https://devfeed.tech/topics/bugbounty.md>), [Security](<https://devfeed.tech/topics/security.md>), [Open Source](<https://devfeed.tech/topics/open-source.md>), [Ruby](<https://devfeed.tech/topics/ruby.md>)

Tags: [application-security](<https://devfeed.tech/tags/application-security.md>), [bug-bounty](<https://devfeed.tech/tags/bug-bounty.md>), [open-source](<https://devfeed.tech/tags/open-source.md>), [rails](<https://devfeed.tech/tags/rails.md>), [remote-code-execution](<https://devfeed.tech/tags/remote-code-execution.md>), [ruby](<https://devfeed.tech/tags/ruby.md>), [serialization](<https://devfeed.tech/tags/serialization.md>), [shopify](<https://devfeed.tech/tags/shopify.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

Shopify describes how a bug bounty report led to contributions that improve the security of the Rails library. The report identified a deserialization vulnerability in ActiveSupport's MessageEncryptor, where leaked development secrets could enable seemingly trusted data and potentially remote code execution. Shopify addressed the issue in its system, helped Rails adopt safer default serializers, and developed tools to help Ruby application developers identify similar risks.

## Source excerpt

Zack Deveau, Senior Application Security Engineer at Shopify, shares the details behind a recent contribution to the Rails library, inspired by a bug bounty report we received. He'll go over the report and its root cause, how we fixed it in our system, and how we took it a step further to make Rails more secure by updating the default serializer for a few classes to use safe defaults.