---
title: Database query may not be scoped by shop
description: >-
  Detects database queries in authenticated routes that don't reference the shop
  domain or session.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/missing-tenant-isolation
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/missing-tenant-isolation.md
---

# Database query may not be scoped by shop

Detects database queries in authenticated routes that don't reference the shop domain or session.

| Detail | Value |
| - | - |
| Check ID | `MISSING_TENANT_ISOLATION` |
| Severity | High |
| How it runs | Agent review |

***

## Vulnerable example

## app/routes/app.orders.$id.tsx

```tsx
import type { LoaderFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";
import prisma from "../db.server";


export const loader = async ({ request, params }: LoaderFunctionArgs) => {
  await authenticate.admin(request);


  // Authenticated, but the row is selected by id alone: any
  // installed shop can read any other shop's order by guessing or
  // enumerating the id.
  return {
    order: await prisma.order.findUnique({ where: { id: params.id } }),
  };
};
```

***

## How to fix

Add the authenticated shop to the query's `where` clause.

For more detail, see [Session tokens](https://shopify.dev/docs/apps/build/authentication-authorization/session-tokens).

## app/routes/app.orders.$id.tsx

```tsx
import type { LoaderFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";
import prisma from "../db.server";


export const loader = async ({ request, params }: LoaderFunctionArgs) => {
  const { session } = await authenticate.admin(request);


  // Every tenant-owned read carries the shop in its where clause.
  const order = await prisma.order.findFirst({
    where: { id: params.id, shop: session.shop },
  });


  if (!order) throw new Response("Not found", { status: 404 });


  return { order };
};
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***