Missing mandatory GDPR compliance webhooks
Detects apps missing mandatory compliance webhooks (shop/redact, customers/data_request, customers/redact).
| Detail | Value |
|---|---|
| Check ID | MISSING_COMPLIANCE_WEBHOOKS |
| Severity | Medium |
| How it runs | Deterministic scan and agent review |
Anchor to Vulnerable exampleVulnerable example
shopify.app.toml
[webhooks]
api_version = "2025-10"
[[webhooks.subscriptions]]
topics = [ "app/uninstalled" ]
uri = "/webhooks/app/uninstalled"
# The three mandatory privacy topics are missing. Every public
# app has to subscribe to them, whether or not it stores
# customer data.
Anchor to How to fixHow to fix
Add the missing webhook subscriptions to shopify.app.toml.
For more detail, see Mandatory webhooks.
shopify.app.toml
[webhooks]
api_version = "2025-10"
[[webhooks.subscriptions]]
topics = [ "app/uninstalled" ]
uri = "/webhooks/app/uninstalled"
[[webhooks.subscriptions]]
uri = "/webhooks/customers/data_request"
compliance_topics = [ "customers/data_request" ]
[[webhooks.subscriptions]]
uri = "/webhooks/customers/redact"
compliance_topics = [ "customers/redact" ]
[[webhooks.subscriptions]]
uri = "/webhooks/shop/redact"
compliance_topics = [ "shop/redact" ]
shopify app security check, the command that runs this check- All app security checks
Was this page helpful?