Check your app on every release
Run the app security checks before you submit your app and again on every release, against every codebase that can read or change merchant data.
The checks look for Shopify-specific security issues that generic tools miss, such as a database query that isn't scoped to one shop, a route that doesn't authenticate requests, or a webhook handler that skips signature verification. A new feature can reintroduce an issue that an earlier release fixed.
The checks read your source code. They don't test your app while it runs, so a clean result isn't proof that your app is secure. Use them alongside your existing security tools and reviews.
The recommended way to run the checks is through your coding agent with Shopify AI Toolkit installed, which investigates the checks that code inspection alone can't settle and walks you through the results. Each finding names a check ID, and each check has a page that shows the fix. See App security checks for both the agent and the CLI workflows.
By default, the checks scan only your app directory. If code that can read or change merchant data lives somewhere else, such as a separate backend, an internal admin or support tool, or a shared library, then scan it too:
- Pass
--include-dirto add a directory to your app's scan. Repeat the flag for more directories. - Pass
--without-app-configwith--pathand--client-idto scan a separate repository that has no app configuration file.
For examples, see shopify app security check.