---
title: Check your app on every release
description: >-
  Run the app security checks before you submit your app and on every release,
  against every codebase that can read or change merchant data.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/monitoring-and-response/check-your-app-on-every-release
  md: >-
    https://shopify.dev/docs/apps/build/security/monitoring-and-response/check-your-app-on-every-release.md
---

# Check your app on every release

Run the [app security checks](https://shopify.dev/docs/apps/build/security/app-security-checks) before you submit your app and again on every release, against every codebase that can read or change merchant data.

***

## Why

The checks look for Shopify-specific security issues that generic tools miss, such as a database query that isn't scoped to one shop, a route that doesn't authenticate requests, or a webhook handler that skips signature verification. A new feature can reintroduce an issue that an earlier release fixed.

The checks read your source code. They don't test your app while it runs, so a clean result isn't proof that your app is secure. Use them alongside your existing security tools and reviews.

***

## How

The recommended way to run the checks is through your coding agent with [Shopify AI Toolkit](https://shopify.dev/docs/apps/build/ai-toolkit) installed, which investigates the checks that code inspection alone can't settle and walks you through the results. Each finding names a check ID, and each check has a page that shows the fix. See [App security checks](https://shopify.dev/docs/apps/build/security/app-security-checks) for both the agent and the CLI workflows.

By default, the checks scan only your app directory. If code that can read or change merchant data lives somewhere else, such as a separate backend, an [internal admin or support tool](https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/secure-internal-tools), or a shared library, then scan it too:

* Pass `--include-dir` to add a directory to your app's scan. Repeat the flag for more directories.
* Pass `--without-app-config` with `--path` and `--client-id` to scan a separate repository that has no app configuration file.

For examples, see [`shopify app security check`](https://shopify.dev/docs/api/shopify-cli/app/app-security-check).

***