---
title: Data access may exceed the current request
description: >-
  Investigates reads that may expose data outside the authenticated shop or user
  boundary.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/overbroad-data-access
  md: >-
    https://shopify.dev/docs/apps/build/security/app-security-checks/overbroad-data-access.md
---

# Data access may exceed the current request

Investigates reads that may expose data outside the authenticated shop or user boundary.

| Detail | Value |
| - | - |
| Check ID | `OVERBROAD_DATA_ACCESS` |
| Severity | Medium |
| How it runs | Agent review |

***

## Vulnerable example

## app/routes/app.orders.status.tsx

```tsx
import type { LoaderFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";
import prisma from "../db.server";


export const loader = async ({ request }: LoaderFunctionArgs) => {
  const { session } = await authenticate.admin(request);


  // The page renders a status badge, but the loader ships every
  // column, including the customer's email, phone, and address, to
  // the browser.
  return {
    orders: await prisma.order.findMany({ where: { shop: session.shop } }),
  };
};
```

***

## How to fix

Scope data access to the authenticated shop and minimum necessary records.

## app/routes/app.orders.status.tsx

```tsx
import type { LoaderFunctionArgs } from "react-router";


import { authenticate } from "../shopify.server";
import prisma from "../db.server";


export const loader = async ({ request }: LoaderFunctionArgs) => {
  const { session } = await authenticate.admin(request);


  // Select the fields the view actually renders. Personal data
  // that never leaves the server can't leak through a loader
  // payload or an error report.
  return {
    orders: await prisma.order.findMany({
      where: { shop: session.shop },
      select: { id: true, name: true, fulfillmentStatus: true },
    }),
  };
};
```

***

## Related

* [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check), the command that runs this check
* [All app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks)

***