Disclaimer: While I’m discussing how Shopify could implement better safeguards against this, I fully acknowledge that keeping my DNS clean and removing unused subdomains is ultimately my own responsibility.
A stray DNS record from a project I shut down two years ago came back to bite me this week.
Out of nowhere, I got a Google Search Console alert letting me know an unknown user (******@gmail.com) had been verified as a new owner for one of my subdomains: electrouse.workouse.com.
Since all my domains are managed through Cloudflare, I immediately dug into my DNS records to figure out how someone else managed to verify ownership of my site.
https://blog.emre.xyz/posts/how-i-hacked-by-subdomain-takeover-shopify/
submitted by /u/aybarscengaver to r/shopify
[link] [comments]
Source: r/shopify · by /u/aybarscengaver