Hi there
We would like to do a pen test against our website which is hosted on the Shopify platform.
Is this allowed? Do we need to request authorisation? If so, how do we do this?
Thank you
Just to be clear to any future readers shopify is not just a hosting service such as for a wordpress site where clients still maintain a level of responsibility for backend behavior via code . Shopify is a SASS platform where you access a managed proprietary environment which include shopify’s own security experts running the platform. This means the lions share of businesses pen testing should probably be directed internally at a merchants processes such as password practices, 2 factor auth, staff education against things like phishing, desktop OS updates,etc etc.
Pen testers probably want to reach out through the shopify bug bounty program for insight on who to connect with for such matters.
https://hackerone.com/shopify?type=team
Benign stuff like javascript auditing the frontend, etc should always be kosher; basically anything running parallel to what you’d do in benign performance testing or quality assurance.
Beyond that is grayspace, obviously with more sensitivity when it’s the frontend customer accounts or the checkout process.