---
title: app security review
description: Show the combined app security check results.
source_url:
  html: 'https://shopify.dev/docs/api/shopify-cli/app/app-security-review'
  md: 'https://shopify.dev/docs/api/shopify-cli/app/app-security-review.md'
api_name: shopify-cli
---

# app security review

Shows the combined results of an app security check: the deterministic scan from [`app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), and the findings that your coding agent recorded with [`app security record`](https://shopify.dev/docs/api/shopify-cli/app/app-security-record). Each check is listed with its findings, status, and source, most severe first.

Agent findings are optional. Without them, the command shows the deterministic scan results. Each finding names a check ID, and that check's page under [app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks) explains how to fix it.

Pass the same `--path`, `--config`, `--client-id`, and `--without-app-config` flags that you passed to [`app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), so that the command finds the same results.

#### Flags

The following flags are available for the `app security review` command:

* **--blocking \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_APP\_SECURITY\_BLOCKING**

  The minimum finding severity that causes a non-zero exit code: high, medium, or low. Defaults to none, which never fails on findings.

* **--check-id \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_CHECK\_ID**

  Show only this check. Repeat the flag to show several checks.

* **--client-id \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_CLIENT\_ID**

  The Client ID of your app.

* **--json-schema**

  **env: SHOPIFY\_FLAG\_JSON\_SCHEMA**

  Print the command's JSON schemas.

* **--no-color**

  **env: SHOPIFY\_FLAG\_NO\_COLOR**

  Disable color output.

* **--no-input**

  **env: SHOPIFY\_FLAG\_NO\_INPUT**

  Disable interactive prompts and browser authentication.

* **--path \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_PATH**

  The path to your app directory.

* **--verbose**

  **env: SHOPIFY\_FLAG\_VERBOSE**

  Increase the verbosity of the output. May include sensitive data.

* **--without-app-config**

  **env: SHOPIFY\_FLAG\_WITHOUT\_APP\_CONFIG**

  Scan --path as an app with no app configuration file. Config checks are skipped. Requires --client-id.

* **-c, --config \<value>**

  **string**

  **env: SHOPIFY\_FLAG\_APP\_CONFIG**

  The name of the app configuration.

### Examples

* #### App security review

  ##### app security review

  ```sh
  shopify app security review
  ```

* #### Review specific checks

  ##### Description

  Pass \`--check-id\` to show only the checks that you name, and \`--verbose\` to include the full reasoning, evidence, and suppressed findings.

  ##### app security review --check-id

  ```sh
  shopify app security review --check-id COMMITTED_SECRET --check-id SQL_INJECTION --verbose
  ```

***