Keep secrets out of shipped code and logs
Keep access tokens, refresh tokens, your client secret, and every other credential on your server, out of anything you ship and out of anything you log.
Anything in a theme or app bundle is public. Automated scanners continuously crawl published storefronts and public repositories for credential patterns, including secrets that were removed but are still in earlier commits. The usual places secrets turn up are Liquid templates, theme assets, JavaScript bundles, source maps, build-time environment variables inlined at compile time, HTML comments, and hidden form fields.
Anything you put in shipped code should be harmless in an attacker's hands. On your server:
- Don't write access tokens, refresh tokens, or your client secret to logs, error reports, or analytics events.
- Don't send them to the browser in loader data, page globals, or API responses.
- Keep
.envfiles and other files that hold secrets out of version control.
For more on handling your app's credentials, see Manage your app credentials. If a secret is exposed, then revoke or rotate it immediately. Don't wait for confirmation that someone used it.