# Customer's full name disclosure via Shopify Chat (by email lookup)

Shopify Chat's skip_customer_creation flag could be flipped to false, causing the API to resolve an email to a customer's full name.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: imgnotfound
- Disclosed: 2020-11-19
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1018336
- Library page: https://bugbountylibrary.com/r/h1%3A1018336
- Tags: area:web domain:web impact:pii-leak kind:bounty platform:hackerone sev:medium tech:rest technique:param-pollution vuln:info-disclosure

**Target:** Shopify Chat storefront conversations API
**Root cause:** The storefront messages endpoint trusts a client-supplied skip_customer_creation flag; setting it false triggers customer creation/lookup by email, and the response's conversations.name reflects the matched customer's full name.
**Steps:**
1. Open `https://{shop}.myshopify.com/?chat` in incognito with Shopify Chat installed
2. Choose 'I need an update on my order' then 'Enter order information'
3. Enter target email and any order number, click Send
4. Intercept POST to `https://shopify-chat.shopifycloud.com/api/storefront/conversations/{id}/messages`
5. Change `skip_customer_creation` from true to false and forward
6. Read response of the messages GET; `conversations.name` contains the target's full name
**How found:** Noticed the client-controlled skip_customer_creation flag in the intercepted request and hypothesized that disabling it would make the backend resolve/create a customer from the supplied email, leaking the name.
**Exploitation:** Attacker submits arbitrary email in the chat order-lookup flow, flips skip_customer_creation to false, and reads the returned conversation name to harvest full names for any email.
**Insight:** Client-supplied flags like skip_customer_creation often gate server-side identity resolution; flipping them can turn a benign flow into an email-to-PII oracle.