Cloud Security Alliance Webinar Recap: Avoid the Breach with Shopify’s Andrew Dunbar

This CSA fireside chat summarizes Shopify’s application security approach, focusing on automation, standardized tooling and environments, close partnerships between security and product engineers, and pragmatic risk management. Key points include vetting new languages and tools via Hack Days, building vulnerability-management tooling that integrates with developer workflows, a simple high/low risk rating model, the concept of “trust batteries” for stakeholder trust, and reliance on bug-bounty programs to surface hard-to-find issues.