app security record

Records the findings that your coding agent reports after an app security check. The command reads the agent's complete findings document from standard input, validates it, and replaces any findings recorded earlier. If anything in the document is invalid, then the command lists every error and records nothing.

You don't usually run this command yourself: the instructions that app security check prints tell your coding agent how to run it. To see the combined results afterward, run app security review.

The command needs the results of an earlier app security check. Pass it the same --path, --config, --client-id, and --without-app-config flags that you passed to app security check, so that the command finds the same results.

Anchor to flagsFlags

The following flags are available for the app security record command:

Anchor to --client-id <value> --client-id <value> string env: SHOPIFY_FLAG_CLIENT_ID: The Client ID of your app.
Anchor to --json-schema --json-schema env: SHOPIFY_FLAG_JSON_SCHEMA: Print the command's JSON schemas.
Anchor to --no-color --no-color env: SHOPIFY_FLAG_NO_COLOR: Disable color output.
Anchor to --no-input --no-input env: SHOPIFY_FLAG_NO_INPUT: Disable interactive prompts and browser authentication.
Anchor to --path <value> --path <value> string env: SHOPIFY_FLAG_PATH: The path to your app directory.
Anchor to --verbose --verbose env: SHOPIFY_FLAG_VERBOSE: Increase the verbosity of the output. May include sensitive data.
Anchor to --without-app-config --without-app-config env: SHOPIFY_FLAG_WITHOUT_APP_CONFIG: Scan --path as an app with no app configuration file. Config checks are skipped. Requires --client-id.
Anchor to -c, --config <value> -c, --config <value> string env: SHOPIFY_FLAG_APP_CONFIG: The name of the app configuration.

Examples