Merchants install your app because they trust it, and because they trust the Shopify App Store. There are bad actors out there who are motivated to exploit that trust. Alongside the rest of the industry, we are seeing the number of attacks increasing across the app ecosystem as AI gets better at finding vulnerabilities.
Security is the most important thing you can work on right now. We’re asking every app developer to act on the steps below this week.
- Scan your app with our new security check. A single prompt with AI Toolkit checks for Shopify-specific vulnerabilities, such as unauthenticated routes, cross-shop data access and unverified webhooks. In early access, most partners found something they didn’t know about.
- Move to expiring access tokens. Short-lived tokens limit the damage if a token leaks. This will soon be required for all public apps, so start your migration now.
- Use vulnerability scanners to ensure all endpoints of your app are secured.
- Treat all rendered data, whether pulled from metafields or your own servers, as untrusted, ensuring inputs are thoroughly escaped and sanitized.
- Check your Dev Dashboard to look at your API requests and ensure you do not see any suspicious activity. To get started, filter your logs by client IP to look at traffic patterns and find suspicious sources.
- Protect every account that touches your app. Turn on two-step authentication for your Partner account, hosting, CDN, code repositories and email. Remove access for anyone who no longer needs it.
- Keep your emergency contact current. Make sure your emergency developer email in the Partner Dashboard reaches someone who can act quickly.
- Review and apply the security best practices in Shopify Dev Docs.
Anchor to What we’re doing alongside youWhat we’re doing alongside you
We’re tightening the boundaries for storefront app code, adding IP address restrictions so your keys only work from your servers, and raising App Store security requirements. We’ll share details and timelines with you before any change takes effect, so you have time to prepare. We’ll keep investing in platform protections, developer tools and guidance that make secure development the default.
If you ever suspect a security issue with your app, notify us immediately at partner-security-reports@shopify.com. You are accountable to fix the problem and notify affected merchants, and we’ll support you through it.
For general security inquiries, contact Shopify Support.