This metric captures the actions that must be taken by the attacker to actively evade or circumvent existing built-in security-enhancing conditions. High complexity indicates the attacker must take specific actions such as evading exploit mitigation techniques or obtaining target-specific secrets.

This metric captures prerequisite deployment and execution conditions or variables of the vulnerable system that enable the attack. Present indicates that specific conditions must exist for successful exploitation, such as race conditions, specific system configurations, feature flags, or particular account states.

This metric describes the level of privileges an attacker must possess before successfully exploiting the vulnerability. This Base Score increases as fewer privileges are required.

This metric captures the requirement for a user, other than the attacker, to participate in the successful compromise of the vulnerable component. This metric determines whether the vulnerability can be exploited solely at the will of the attacker, or whether a separate user (or user-initiated process) must participate in some manner. The Base Score is highest when no user interaction is required.

This metric measures the impact to the confidentiality of the information resources managed by a software component due to a successfully exploited vulnerability. Confidentiality refers to limiting information access and disclosure to only authorized users, as well as preventing access by or disclosure to unauthorized ones.

This metric measures the impact to the integrity of a system or data due to a successfully exploited vulnerability. Integrity refers to the trustworthiness and veracity of information resources.

This metric measures the impact to the availability of the impacted component resulting from a successfully exploited vulnerability. It refers to the loss of availability of the impacted component itself, such as a networked service (e.g., web, database, email). Since availability refers to the accessibility of information resources, attacks that consume network bandwidth, processor cycles, or disk space all impact the availability of an impacted component.

This metric determines whether an exploit can be reliably automated across multiple targets with minimal adaptation. An attack is considered "Automatable" if the exploitation process can be fully automated across all stages of the chain, enabling large-scale attacks. An attack is "Not Automatable" if it requires multiple manual steps, user interaction, target-specific context, or manual discovery for each individual target.

This metric measures the depth of impact - how much sensitive information or control an attacker gains from a single exploitation event. Value Density evaluates the extent of control over Shopify resources, ranging from minor merchant data (Diffused) to comprehensive access to critical systems or large amounts of sensitive data (Concentrated). This metric focuses on the richness of what is gained per attack, not the breadth across multiple targets.