---
title: Don't serve user-written code to storefronts
description: >-
  Don't let users write JavaScript, HTML, or CSS that your app stores and then
  supplies to storefronts at runtime. Offer structured settings instead.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/storefront/limit-who-can-set-custom-code
  md: >-
    https://shopify.dev/docs/apps/build/security/storefront/limit-who-can-set-custom-code.md
---

# Don't serve user-written code to storefronts

Don't let users write JavaScript, HTML, or CSS that your app stores and then supplies to a storefront at runtime.

***

## Why

When your app accepts code from a user and serves it to a storefront, your app becomes the delivery path for that code. Anyone who can reach the setting, through a compromised merchant account, a support tool, or an [unauthenticated endpoint](https://shopify.dev/docs/apps/build/security/backend/authenticate-every-request), can run their own script for every buyer on the store.

***

## How

* Offer structured settings or a fixed set of options instead, such as colors, fonts, layouts, and text that you render escaped.
* If merchants need custom CSS, then validate it when it's saved, as described in [Escape every value for its context](https://shopify.dev/docs/apps/build/security/storefront/escape-every-value-for-its-context). Don't accept custom JavaScript or HTML.
* If you can't remove an existing custom code setting yet, then let only the store owner change it. Use [online access tokens](https://shopify.dev/docs/apps/build/authentication-authorization/access-tokens#online-access-tokens) to identify the user, keep support staff and internal tools out of it, and log every change with who made it, when, and the old and new values.
* Check the custom code that you've already stored, as described in [Audit stored settings and custom code](https://shopify.dev/docs/apps/build/security/monitoring-and-response/audit-stored-settings-and-custom-code).

***

## Verify

No app security check covers this practice. Find every setting that stores JavaScript, HTML, or CSS, and every place that renders it or returns it to a storefront.

***