--- title: app security check description: Check an app for Shopify-specific security issues. source_url: html: 'https://shopify.dev/docs/api/shopify-cli/app/app-security-check' md: 'https://shopify.dev/docs/api/shopify-cli/app/app-security-check.md' api_name: shopify-cli --- # app security check Checks your app for Shopify-specific security issues. Run it before you submit an app, and on every release, to catch Shopify-specific problems in your own code. For example, a committed credential, a query that isn't scoped to one shop, or a webhook nobody verifies. **Caution:** This command is limited to checking your app's source code, and should be part of a layered approach to security. [Read more](https://shopify.dev/docs/apps/build/security) about improving the security of your app. The recommended way to run it is through your coding agent with [Shopify AI Toolkit](https://shopify.dev/docs/apps/build/ai-toolkit) installed. Ask your agent: ## Example prompt /shopify Check my app for security vulnerabilities Your agent runs this command, investigates the checks that can't be determined by code inspection alone, and walks you through the results. Running the command on its own gives you only the deterministic scan, plus instructions that you can hand to your coding agent. For the full flow, see [app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks). Results are stored in `.shopify/app-security/`. #### Flags The following flags are available for the `app security check` command: * **--blocking \** **string** **env: SHOPIFY\_FLAG\_APP\_SECURITY\_BLOCKING** The minimum finding severity that causes a non-zero exit code: high, medium, or low. Defaults to none, which never fails on findings. * **--client-id \** **string** **env: SHOPIFY\_FLAG\_CLIENT\_ID** The Client ID of your app. * **--exclude \** **string** Skip paths that match this glob, relative to the working directory. Repeat the flag to add globs. The selected app configuration file can't be excluded. * **--include-dir \** **string** Also scan this directory, relative to the working directory. Repeat the flag to add directories. Use it for code that lives outside the app directory, such as a backend or a shared library. * **--json-schema** **env: SHOPIFY\_FLAG\_JSON\_SCHEMA** Print the command's JSON schemas. * **--list-files** **env: SHOPIFY\_FLAG\_LIST\_FILES** Print the files the check would gather, one path per line, and stop. Nothing is scanned, no results are written, and nothing is prompted for. * **--no-color** **env: SHOPIFY\_FLAG\_NO\_COLOR** Disable color output. * **--no-git-ignore** **env: SHOPIFY\_FLAG\_NO\_GIT\_IGNORE** Turn off Git ignore rules for every scanned directory, so files that Git ignores are scanned too. Files that Git tracks are always scanned. * **--no-input** **env: SHOPIFY\_FLAG\_NO\_INPUT** Disable interactive prompts and browser authentication. * **--path \** **string** **env: SHOPIFY\_FLAG\_PATH** The path to your app directory. * **--skip-instructions** **env: SHOPIFY\_FLAG\_APP\_SECURITY\_SKIP\_INSTRUCTIONS** Don't offer the coding-agent instructions after the scan. Use it when you want only the deterministic scan results. * **--verbose** **env: SHOPIFY\_FLAG\_VERBOSE** Increase the verbosity of the output. May include sensitive data. * **--without-app-config** **env: SHOPIFY\_FLAG\_WITHOUT\_APP\_CONFIG** Scan --path as an app with no app configuration file. Config checks are skipped. Requires --client-id. * **--yes** **env: SHOPIFY\_FLAG\_YES** Print coding-agent instructions without prompting. * **-c, --config \** **string** **env: SHOPIFY\_FLAG\_APP\_CONFIG** The name of the app configuration. ### Examples * #### App security check ##### app security check ```sh shopify app security check ``` * #### Scan a backend in another repository ##### Description Pass \`--include-dir\` to scan code that lives outside your app directory, such as a backend or a shared library, along with the app. Repeat the flag to add more directories. ##### app security check --include-dir ```sh shopify app security check --include-dir ../backend ``` * #### Scan an app whose configuration is in a subdirectory ##### Description When the app configuration file isn't at the root of your project, point \`--path\` at the folder that contains it and select the configuration with \`--config\`. \`--include-dir .\` adds the rest of the project to the scan. ##### app security check --path --config --include-dir ```sh shopify app security check --path extensions --config production --include-dir . ``` * #### Scan code without an app configuration file ##### Description Pass \`--without-app-config\` with your app's client ID to scan a directory that has no \`shopify.app.toml\`, such as a separate backend repository. Config checks are skipped. ##### app security check --without-app-config ```sh shopify app security check --without-app-config --client-id ``` * #### Skip paths ##### Description Pass \`--exclude\` with a glob to skip paths that you don't want scanned, such as another app in the same repository or generated code. Quote each glob so your shell doesn't expand it. ##### app security check --exclude ```sh shopify app security check --path app --include-dir . --exclude marketing --exclude '**/generated' ``` * #### Scan files that Git ignores ##### Description Git ignore rules apply by default. Pass \`--no-git-ignore\` to also scan files that Git ignores, such as build output, and use \`--exclude\` for anything that you still want skipped. ##### app security check --no-git-ignore ```sh shopify app security check --no-git-ignore --exclude local-data ``` * #### List the files a check would scan ##### Description Pass \`--list-files\` to print the files that the check would scan and stop, without scanning anything or writing results. ##### app security check --list-files ```sh shopify app security check --include-dir ../backend --list-files ``` *** ## Checks To learn more about the individual checks that this command runs, see [app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks). After the check, your coding agent records its findings with [`app security record`](https://shopify.dev/docs/api/shopify-cli/app/app-security-record), and [`app security review`](https://shopify.dev/docs/api/shopify-cli/app/app-security-review) shows the combined results. Without a coding agent, you get only the deterministic scan results from this command. You don't run `app security record` yourself: it only accepts the findings document that your agent writes. To give your agent the whole workflow at another time, starting with a fresh scan, run [`app security instructions`](https://shopify.dev/docs/api/shopify-cli/app/app-security-instructions). Pass the same `--path`, `--config`, `--client-id`, and `--without-app-config` flags to every `app security` command so that they all use the same results. To delete the results, run [`app security clean`](https://shopify.dev/docs/api/shopify-cli/app/app-security-clean). Each check carries a severity, and each finding takes the severity of the check that reported it. | Severity | What to do about a finding | | - | - | | High | Fix it before you ship: it puts shop data or shop access at risk. | | Medium | Fix it in the same pass where you can. It weakens a boundary without breaking it outright. | | Low | Fix it soon. It isn't an immediate risk, but left alone, your app stops getting security fixes. | [Reference - app security checks\ \ ](https://shopify.dev/docs/apps/build/security/app-security-checks) [Every check, with its severity and a worked example of the fix.](https://shopify.dev/docs/apps/build/security/app-security-checks) ***