# H1514 [*.(my)shopify.com] - Viewing Password Protected Content

Unauthenticated /preview_bar endpoint leaked a store's theme preview URL, which bypassed storefront password protection and exposed protected shop content.

- Payout: $3,000
- Severity: critical
- Program: Shopify
- Credited: corb3nik
- Disclosed: 2019-05-22
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/421859
- Library page: https://bugbountylibrary.com/r/h1%3A421859
- Tags: domain:web impact:data-leak kind:bounty platform:hackerone sev:critical technique:recon vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Shopify storefront /preview_bar endpoint and theme preview domain
**Root cause:** The /preview_bar endpoint generated and returned a preview link without requiring authentication, and preview mode was not gated by the storefront password protection.
**Steps:**
1. Visit a password-protected shop e.g. `https://mycorb3nikshop.myshopify.com`.
2. Request `https://mycorb3nikshop.myshopify.com/preview_bar` unauthenticated and view source.
3. Extract the `shopifypreview.com` URL embedded in the page.
4. Visit the preview URL to view full storefront content without the password.
**How found:** Noticed the preview feature generates shareable unauthenticated links, hypothesized the link generation endpoint itself lacked auth, and checked /preview_bar source for the preview URL.
**Exploitation:** Attacker requests /preview_bar on any target store, scrapes the generated preview domain from the HTML, and loads it to read password-protected storefront content with no credentials.
**Insight:** Features that mint shareable unauthenticated tokens (preview links, share links) often expose the minting endpoint itself; check whether token generation requires auth and whether preview mode skips access gates like password protection.