Order Detail Pages and PII Risks

A researcher found that Shopify’s customizable order status page can leak customer personal data (email, billing and shipping details) in the HTML source when third‑party tracking scripts like Google Customer Reviews or conversion trackers include required fields (merchant_id, order_id, email). Although the order status URL contains a long random token making accidental discovery unlikely, shared links or multiple tracking integrations can expose order identifiers that allow an attacker to retrieve sensitive customer information; the issue was reported to Shopify and they marked it Informative while suggesting documentation and template improvements.