app security check
Checks your app for Shopify-specific security issues.
Run it before you submit an app, and on every release, to catch Shopify-specific problems in your own code. For example, a committed credential, a query that isn't scoped to one shop, or a webhook nobody verifies.
This command is limited to checking your app's source code, and should be part of a layered approach to security. Read more about improving the security of your app.
This command is limited to checking your app's source code, and should be part of a layered approach to security. Read more about improving the security of your app.
The recommended way to run it is through your coding agent with Shopify AI Toolkit installed. Ask your agent:
Example prompt
Your agent runs this command, investigates the checks that can't be determined by code inspection alone, and walks you through the results. Running the command on its own gives you only the deterministic scan, plus instructions that you can hand to your coding agent. For the full flow, see app security checks.
Results are stored in .shopify/app-security/.
Anchor to flagsFlags
The following flags are available for the app security check command:
- Anchor to --blocking <value>--blocking <value>--blocking <value>stringstringenv: SHOPIFY_FLAG_APP_SECURITY_BLOCKINGenv: SHOPIFY_FLAG_APP_SECURITY_BLOCKING
The minimum finding severity that causes a non-zero exit code: high, medium, or low. Defaults to none, which never fails on findings.
- Anchor to --client-id <value>--client-id <value>--client-id <value>stringstringenv: SHOPIFY_FLAG_CLIENT_IDenv: SHOPIFY_FLAG_CLIENT_ID
The Client ID of your app.
- Anchor to --exclude <value>--exclude <value>--exclude <value>stringstring
Skip paths that match this glob, relative to the working directory. Repeat the flag to add globs. The selected app configuration file can't be excluded.
- Anchor to --include-dir <value>--include-dir <value>--include-dir <value>stringstring
Also scan this directory, relative to the working directory. Repeat the flag to add directories. Use it for code that lives outside the app directory, such as a backend or a shared library.
- Anchor to --json-schema--json-schema--json-schemaenv: SHOPIFY_FLAG_JSON_SCHEMAenv: SHOPIFY_FLAG_JSON_SCHEMA
Print the command's JSON schemas.
- Anchor to --list-files--list-files--list-filesenv: SHOPIFY_FLAG_LIST_FILESenv: SHOPIFY_FLAG_LIST_FILES
Print the files the check would gather, one path per line, and stop. Nothing is scanned, no results are written, and nothing is prompted for.
- Anchor to --no-color--no-color--no-colorenv: SHOPIFY_FLAG_NO_COLORenv: SHOPIFY_FLAG_NO_COLOR
Disable color output.
- Anchor to --no-git-ignore--no-git-ignore--no-git-ignoreenv: SHOPIFY_FLAG_NO_GIT_IGNOREenv: SHOPIFY_FLAG_NO_GIT_IGNORE
Turn off Git ignore rules for every scanned directory, so files that Git ignores are scanned too. Files that Git tracks are always scanned.
- Anchor to --no-input--no-input--no-inputenv: SHOPIFY_FLAG_NO_INPUTenv: SHOPIFY_FLAG_NO_INPUT
Disable interactive prompts and browser authentication.
- Anchor to --path <value>--path <value>--path <value>stringstringenv: SHOPIFY_FLAG_PATHenv: SHOPIFY_FLAG_PATH
The path to your app directory.
- Anchor to --print-instructions--print-instructions--print-instructionsenv: SHOPIFY_FLAG_APP_SECURITY_PRINT_INSTRUCTIONSenv: SHOPIFY_FLAG_APP_SECURITY_PRINT_INSTRUCTIONS
Print coding-agent instructions without prompting for how to deliver them.
- Anchor to --skip-instructions--skip-instructions--skip-instructionsenv: SHOPIFY_FLAG_APP_SECURITY_SKIP_INSTRUCTIONSenv: SHOPIFY_FLAG_APP_SECURITY_SKIP_INSTRUCTIONS
Don't offer the coding-agent instructions after the scan. Use it when you want only the deterministic scan results.
- Anchor to --verbose--verbose--verboseenv: SHOPIFY_FLAG_VERBOSEenv: SHOPIFY_FLAG_VERBOSE
Increase the verbosity of the output. May include sensitive data.
- Anchor to --without-app-config--without-app-config--without-app-configenv: SHOPIFY_FLAG_WITHOUT_APP_CONFIGenv: SHOPIFY_FLAG_WITHOUT_APP_CONFIG
Scan --path as an app with no app configuration file. Config checks are skipped. Requires --client-id.
- Anchor to -c, --config <value>-c, --config <value>-c, --config <value>stringstringenv: SHOPIFY_FLAG_APP_CONFIGenv: SHOPIFY_FLAG_APP_CONFIG
The name of the app configuration.
app security check
Examples
App security check
app security check
shopify app security checkScan a backend in another repository
Description
Pass `--include-dir` to scan code that lives outside your app directory, such as a backend or a shared library, along with the app. Repeat the flag to add more directories.
app security check --include-dir
shopify app security check --include-dir ../backendScan an app whose configuration is in a subdirectory
Description
When the app configuration file isn't at the root of your project, point `--path` at the folder that contains it and select the configuration with `--config`. `--include-dir .` adds the rest of the project to the scan.
app security check --path --config --include-dir
shopify app security check --path extensions --config production --include-dir .Scan code without an app configuration file
Description
Pass `--without-app-config` with your app's client ID to scan a directory that has no `shopify.app.toml`, such as a separate backend repository. Config checks are skipped.
app security check --without-app-config
shopify app security check --without-app-config --client-id <client-id>Skip paths
Description
Pass `--exclude` with a glob to skip paths that you don't want scanned, such as another app in the same repository or generated code. Quote each glob so your shell doesn't expand it.
app security check --exclude
shopify app security check --path app --include-dir . --exclude marketing --exclude '**/generated'Scan files that Git ignores
Description
Git ignore rules apply by default. Pass `--no-git-ignore` to also scan files that Git ignores, such as build output, and use `--exclude` for anything that you still want skipped.
app security check --no-git-ignore
shopify app security check --no-git-ignore --exclude local-dataList the files a check would scan
Description
Pass `--list-files` to print the files that the check would scan and stop, without scanning anything or writing results.
app security check --list-files
shopify app security check --include-dir ../backend --list-files
Anchor to ChecksChecks
To learn more about the individual checks that this command runs, see app security checks.
After the check, your coding agent records its findings with app security record, and app security review shows the combined results. Without a coding agent, you get only the deterministic scan results from this command. You don't run app security record yourself: it only accepts the findings document that your agent writes. To give your agent the whole workflow at another time, starting with a fresh scan, run app security instructions. Pass the same --path, --config, --client-id, and --without-app-config flags to every app security command so that they all use the same results. To delete the results, run app security clean.
Each check carries a severity, and each finding takes the severity of the check that reported it.
| Severity | What to do about a finding |
|---|---|
| High | Fix it before you ship: it puts shop data or shop access at risk. |
| Medium | Fix it in the same pass where you can. It weakens a boundary without breaking it outright. |
| Low | Fix it soon. It isn't an immediate risk, but left alone, your app stops getting security fixes. |
