---
title: Respond to a security incident
description: >-
  Write your incident plan before you need it, and act on the first credible
  sign of a compromise rather than waiting for a complete picture.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/monitoring-and-response/respond-to-a-security-incident
  md: >-
    https://shopify.dev/docs/apps/build/security/monitoring-and-response/respond-to-a-security-incident.md
---

# Respond to a security incident

Write your incident plan before you need it, and act on the first credible sign of a compromise rather than waiting for a complete picture.

***

## Why

Early notice gives Shopify and the affected merchants more time to protect buyers, so don't wait for certainty before you tell us.

***

## How

If you suspect a compromise:

1. Contain it. Stop the affected operation or isolate the service.
2. Revoke exposed credentials, tokens, and sessions. To replace your app's client secret, see [Rotate your client secret](https://shopify.dev/docs/apps/build/authentication-authorization/manage-credentials#rotate-your-client-secret). Revoking the old secret is what invalidates any non-expiring tokens issued with it.
3. Preserve logs and evidence before they roll off.
4. Notify Shopify at <security@shopify.com>.
5. Determine which stores, users, and data were affected. Your app's [logs in the Dev Dashboard](https://shopify.dev/docs/apps/build/dev-dashboard/monitoring-and-logs#logs) show the shop, client IP address, and user agent of each GraphQL Admin API and REST Admin API request made with its access tokens over the last 30 days.
6. Fix the root cause, not just the symptom you noticed.
7. Meet your legal and contractual notification obligations.
8. Write up what happened and what control would have caught it.

After you fix the path that was used, [audit what's already stored](https://shopify.dev/docs/apps/build/security/monitoring-and-response/audit-stored-settings-and-custom-code), because fixing the path doesn't remove what came through it.

***

## Verify

No app security check covers this practice. Walk through the plan with your team once a year, and after any real incident.

***