Deprecated Script
Detects the deprecated write_script_tags OAuth scope in shopify.app.toml.
| Detail | Value |
|---|---|
| Check ID | DEPRECATED_SCRIPT_TAG_SCOPE |
| Severity | Medium |
| How it runs | Deterministic scan and agent review |
Anchor to Vulnerable exampleVulnerable example
shopify.app.toml
[access_scopes]
# write_script_tags is deprecated: it injects scripts the
# merchant can't see or manage from the theme editor.
scopes = "write_products,write_script_tags"
Anchor to How to fixHow to fix
Remove write_script_tags from scopes and migrate to app embeds.
For more detail, see App embed blocks.
shopify.app.toml
[access_scopes]
scopes = "write_products"
# Storefront JavaScript now ships as a theme app extension. The
# merchant adds and removes the app embed themselves, and the
# asset is versioned with your extension.
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?