# Create free Shopify application credits.

Shopify GraphiQL app exposed the appCreditCreate mutation to staff with only apps permission, letting them mint unlimited free app credits.

- Payout: hidden
- Severity: medium
- Program: Shopify
- Found by: jmp_35p
- Disclosed: 2021-09-10
- Write-up quality: 6/10
- Original: https://hackerone.com/reports/1257428
- Library page: https://bugbountylibrary.com/r/h1%3A1257428
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:graphql technique:source-review vuln:access-control vuln:business-logic

**Target:** Shopify GraphiQL app GraphQL admin API (appCreditCreate mutation)
**Root cause:** The appCreditCreate mutation, intended to be restricted from store owners/staff with only apps permission, was reachable through the Shopify GraphiQL app's proxied admin GraphQL endpoint.
**Steps:**
1. Install Shopify GraphiQL app as staff with apps permission.
2. Capture the POST to `/admin/api/2021-07/graphql` on shopify-graphiql-app.shopifycloud.com.
3. Replace body with `mutation AppCreditCreatePayload` calling `appCreditCreate(description:"Themes credits", amount:{amount:500.00, currencyCode:"USD"}, test:false)`.
4. Send request; verify $500 credit appears on billing page.
**How found:** Researcher read the billing API docs, noted appCreditCreate should be restricted from apps-permission staff, and tested whether the GraphiQL app still exposed it.
**Exploitation:** Staff with apps permission issues the appCreditCreate mutation via the GraphiQL app to mint arbitrary app credits, confirmed by $500 credit appearing on the billing page.
**Escalation:** Repeat mutation to create unlimited credits.
**Insight:** First-party developer tooling (GraphiQL/API consoles) often proxies admin GraphQL with broader scope than the UI enforces; compare documented permission requirements against what the console actually permits.