---
title: Hold internal tools to the same standard as your app
description: >-
  Give every internal dashboard, support tool, and admin panel that can change
  merchant settings the same authentication, network boundary, and escaping as
  your app.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/secure-internal-tools
  md: >-
    https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/secure-internal-tools.md
---

# Hold internal tools to the same standard as your app

Give every internal dashboard, support tool, and admin panel that can change merchant settings the same authentication, network boundary, and escaping as your app.

***

## Why

Internal tools are part of your app's attack surface even when they live in a separate project with their own login. They're discoverable through URLs in public JavaScript bundles, predictable subdomains, and certificate transparency logs, which publish the hostname on every TLS certificate issued. A stored cross-site scripting bug in a tool that renders merchant data becomes a cross-store attack, because the script runs with the access of the staff member viewing it.

***

## How

Apply the following to each tool that can read or change merchant data:

* Require real authentication, with two-step authentication or single sign-on, and authorize each action. An unlisted URL isn't access control.
* Put the tool on a private network or behind a VPN.
* Escape all merchant data that the tool renders. See [Render untrusted content as text](https://shopify.dev/docs/apps/build/security/backend/render-untrusted-content-as-text).
* Limit which staff can change storefront-rendered settings, and log every change.
* Include the tool's code when you [check your app on every release](https://shopify.dev/docs/apps/build/security/monitoring-and-response/check-your-app-on-every-release).

***

## Verify

The app security checks cover an internal tool only when you scan its code. See [Check your app on every release](https://shopify.dev/docs/apps/build/security/monitoring-and-response/check-your-app-on-every-release) for how to scan a separate repository.

***