---
title: app security instructions
description: Provide app security check instructions to a coding agent.
source_url:
  html: 'https://shopify.dev/docs/api/shopify-cli/app/app-security-instructions'
  md: 'https://shopify.dev/docs/api/shopify-cli/app/app-security-instructions.md'
api_name: shopify-cli
---

# app security instructions

Prints the workflow that a coding agent follows to review your app's security: run [`app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), investigate the checks that can't be determined by code inspection alone, record its findings with [`app security record`](https://shopify.dev/docs/api/shopify-cli/app/app-security-record), and show the combined results with [`app security review`](https://shopify.dev/docs/api/shopify-cli/app/app-security-review).

The workflow starts with a fresh scan. It doesn't need an earlier `app security check` or reuse its options: the instructions tell your agent to decide what to scan, such as extra directories to add with `--include-dir`, and then run the check itself. Use this command to hand your agent the whole workflow at any time, to copy it to your clipboard, or to write it to a file.

Use `--path`, `--config`, `--client-id`, and `--without-app-config` to select the app. The commands in the instructions use the same selection.

#### Flags

The following flags are available for the `app security instructions` command:

* **--client-id \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_CLIENT\_ID**

  The Client ID of your app.

* **--copy**

  **env: SHOPIFY\_FLAG\_APP\_SECURITY\_INSTRUCTIONS\_COPY**

  Copy the instructions to the clipboard instead of printing them.

* **--json-schema**

  **env: SHOPIFY\_FLAG\_JSON\_SCHEMA**

  Print the command's JSON schemas.

* **--no-color**

  **env: SHOPIFY\_FLAG\_NO\_COLOR**

  Disable color output.

* **--no-input**

  **env: SHOPIFY\_FLAG\_NO\_INPUT**

  Disable interactive prompts and browser authentication.

* **--path \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_PATH**

  The path to your app directory.

* **--verbose**

  **env: SHOPIFY\_FLAG\_VERBOSE**

  Increase the verbosity of the output. May include sensitive data.

* **--without-app-config**

  **env: SHOPIFY\_FLAG\_WITHOUT\_APP\_CONFIG**

  Scan --path as an app with no app configuration file. Config checks are skipped. Requires --client-id.

* **--write \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_APP\_SECURITY\_INSTRUCTIONS\_WRITE**

  Write the instructions to a file instead of printing them.

* **-c, --config \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_APP\_CONFIG**

  The name of the app configuration.

### Examples

* #### App security instructions

  ##### app security instructions

  ```sh
  shopify app security instructions
  ```

* #### Copy the instructions

  ##### Description

  Pass \`--copy\` to copy the instructions to your clipboard instead of printing them.

  ##### app security instructions --copy

  ```sh
  shopify app security instructions --copy
  ```

* #### Write the instructions to a file

  ##### Description

  Pass \`--write\` with a file path to write the instructions to a file instead of printing them.

  ##### app security instructions --write

  ```sh
  shopify app security instructions --write app-security-instructions.md
  ```

***