Shopify App Security Check Finds Vulnerabilities

This is a practical security baseline for Shopify developers, especially teams shipping AI-assisted code, but it is a source scanner—not a complete security program.

• –Detects issues such as committed secrets, missing authorization, unscoped merchant-data queries, and unverified webhooks
• –Agent-assisted review works across React Router, Rails, Django, Laravel, and custom authentication setups
• –Local scanning keeps app source on the developer’s machine and stores results under `.shopify/app-security/`
• –The CLI supports blocking releases based on high, medium, or low-severity findings
• –Shopify explicitly recommends pairing it with runtime testing, dependency scanning, and human security review