---
title: Deprecated ScriptTag capability
description: Detects the deprecated `write_script_tags` OAuth scope in `shopify.app.toml`.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/deprecated-script-tag-scope
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/deprecated-script-tag-scope.md
---

# Deprecated Script​Tag capability

Detects the deprecated `write_script_tags` OAuth scope in `shopify.app.toml`.

| Detail | Value |
| - | - |
| Check ID | `DEPRECATED_SCRIPT_TAG_SCOPE` |
| Severity | Medium |
| How it runs | Deterministic scan and agent review |

***

## Vulnerable example

## shopify.app.toml

```toml
[access_scopes]
# write_script_tags is deprecated: it injects scripts the
# merchant can't see or manage from the theme editor.
scopes = "write_products,write_script_tags"
```

***

## How to fix

Remove `write_script_tags` from scopes and migrate to app embeds.

For more detail, see [App embed blocks](https://shopify.dev/docs/apps/build/online-store/theme-app-extensions/configuration#app-embed-blocks).

## shopify.app.toml

```toml
[access_scopes]
scopes = "write_products"


# Storefront JavaScript now ships as a theme app extension. The
# merchant adds and removes the app embed themselves, and the
# asset is versioned with your extension.
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***