---
title: >-
  Build with confidence: Shopify AI Toolkit's security check - Shopify developer
  blog
description: >-
  Check your app for security vulnerabilities with `shopify app security check`.
  Run it before you submit an app, and on every release, to catch problems in
  your own code and get remediation guidance.
source_url:
  html: >-
    https://shopify.dev/changelog/blog/build-more-secure-apps-with-shopify-s-ai-toolkit-security-check
  md: >-
    https://shopify.dev/changelog/blog/build-more-secure-apps-with-shopify-s-ai-toolkit-security-check.md
metadata:
  effectiveApiVersion: ''
  affectedApi: []
  primaryTag:
    displayName: AI Toolkit
    handle: ai-toolkit
  secondaryTag:
    displayName: New
    handle: new
  indicatesActionRequired: false
  createdAt: '2026-10-09T11:33:00-04:00'
  postedAt: '2026-10-15T10:00:00-04:00'
  updatedAt: '2026-10-15T10:08:37-04:00'
  effectiveAt: '2026-10-13T14:00:00-04:00'
---

October 15, 2026

# Build with confidence: Shopify AI Toolkit's security check

Check your app for security vulnerabilities with `shopify app security check`. Run it before you submit an app, and on every release, to catch problems in your own code and get remediation guidance.

DateOctober 15, 2026

FlagsNew

SurfacesAI Toolkit

Shopify AI Toolkit now includes `shopify app security check`, a security command that checks your app for common vulnerabilities before you ship. You can run it before you submit an app, and on every release, to find problems in your own code and get guidance to fix them.

As AI accelerates how you build apps, attackers use the same tools to find and exploit security gaps faster and at lower cost. This tool helps you keep pace by scanning your app for the kinds of issues we see most often in Shopify apps.

## What's new

`shopify app security check` is a new command in Shopify AI Toolkit and Shopify CLI that scans your app for security vulnerabilities.

The command runs locally on your development machine and focuses on the most common vulnerability patterns in Shopify apps. It examines:

* Your app’s codebase
* Configuration across your app’s extension points
* The dependencies your app relies on

Each finding helps you determine where a potential problem is, the possible impact, and how to fix it.

You can learn more in the [Shopify app security checks guide](https://shopify.dev/docs/apps/build/security/app-security-checks).

## Why we're making this change

Merchants trust your apps with orders, customer data, and revenue. To protect that trust, your app needs to keep pace with evolving security threats and patterns.

Partners who tested the tool reported finding issues they didn’t know about, including gaps in authentication and in how merchant data was isolated across stores. By running the command and iterating with a coding agent, they were able to improve their security posture without changing their existing stack or framework.

Security remains a shared responsibility. This tool complements Shopify’s existing platform protections and your own reviews so you can catch more issues earlier in development.

## How it works

With Shopify AI Toolkit installed, ask your coding agent: `/shopify Check my app for common security vulnerabilities`

This directs your agent to run shopify app security check using Shopify CLI. Run it directly to see the provided prompts and context.

And because your agent reads your code, the check isn’t tied to one framework. It supports both public and custom apps, whether you use React Router, Rails, Django, Laravel, or custom authentication, it examines how your app actually works and knows what gaps to look for.

Each finding includes:

* The affected file and line
* The severity and why the issue matters
* A code example that shows one way to fix it
* Links to relevant documentation that explain the pattern and the fix

Start with critical and high-severity findings. Work through them with your coding agent or fix them yourself, review the changes, and run the check again.

Make it part of every release. A clean report isn’t a guarantee of security: use it alongside your existing tools and reviews.

## Help make the tool better

Security is a shared responsibility. We made the tool open source so Shopify and app developers can improve it together.

Share your feedback with us in the [Forum,](https://community.shopify.dev/c/dev-platform/app-security/38) or contribute improvements directly through the open-source [GitHub repository.](https://github.com/Shopify/cli/blob/main/packages/app/src/cli/services/app-security-engine/) Your feedback helps make future checks more useful for everyone.

Securing the ecosystem is a priority and one we will continue to invest in, including existing measures you can find [here](https://shopify.dev/docs/apps/build/security). If you haven't adopted these, now's the time.

[Run the check on your app today](https://shopify.dev/docs/apps/build/security/app-security-checks), then fix what it finds to keep your app secured. Apps that keep up with security guidelines will be in the best position to protect merchants and their business. It’s essential that we prioritize this work together.

## Resources

* [Shopify app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)
* [Secure your Shopify app](https://shopify.dev/docs/apps/build/security)