---
title: Treat runtime configuration as data
description: >-
  Ship code in your theme app extension's assets, and treat anything your
  extension fetches from your servers at runtime as untrusted data, never as
  code.
source_url:
  html: >-
    https://shopify.dev/docs/apps/build/security/storefront/treat-runtime-configuration-as-data
  md: >-
    https://shopify.dev/docs/apps/build/security/storefront/treat-runtime-configuration-as-data.md
---

# Treat runtime configuration as data

Ship code in your extension's assets, and treat anything your extension fetches from your servers at runtime as untrusted data.

***

## Why

If your extension fetches configuration when the storefront loads, then anyone who can change that configuration changes what runs on every store at once, through a staff account, an [internal tool](https://shopify.dev/docs/apps/build/security/infrastructure-and-accounts/secure-internal-tools), or an [unauthenticated endpoint](https://shopify.dev/docs/apps/build/security/backend/authenticate-every-request). Code in your extension's assets is [versioned and deployed](https://shopify.dev/docs/apps/build/app-extensions#versioning-and-deployment) with your app, so a change to it goes through your release process.

***

## How

* Never run code that your extension fetches at runtime. Don't pass fetched values to `eval`, `new Function`, `innerHTML`, or a script element that you create, and don't load scripts from URLs in the response.
* Treat every configuration response as untrusted data. Validate its shape, and render its values with text-only APIs such as `textContent`.
* Keep behavior in your extension's assets, and keep configuration to plain data that selects among behaviors you shipped.

***

## Verify

The app security checks catch `innerHTML` sinks. No check detects code that runs fetched configuration, so search your extension's JavaScript for `eval`, `new Function`, and dynamically created script elements.

***