Every app install is an act of trust. Merchants rely on your apps to run their business and trust them to protect their orders, customers, and revenue. Protecting merchants is work we share.
AI is helping developers build apps and ship faster. But those same capabilities also help attackers find and exploit security gaps with less time, effort, and cost.
As the way we build evolves, so do our defenses. We continually invest in platform protections, developer tools, and guidance to make secure development easier.
Today, we’re adding another tool to support that work.
Anchor to Check for vulnerabilities: a security tool built for Shopify appsCheck for vulnerabilities: a security tool built for Shopify apps
Introducing shopify app security check, a new command in Shopify’s AI Toolkit and CLI that finds security vulnerabilities in your app before attackers do.
Run it before you submit an app and on every new release to find potential vulnerabilities in your own code. The check is built around the most common vulnerability patterns in Shopify apps and looks at everything from your app’s codebase, its configurations across every extension point, and the dependencies it relies on.
Each finding shows where the problem is, why it matters, and how to fix it, so you can hand it straight to your agent to review and work through. It runs locally on your development machine.
We've been testing it with a small group of partners who reported finding vulnerabilities they weren’t aware of, including gaps in authentication and in how merchant data was isolated across stores, and were able to level up their security posture by running the command and iterating with their agent.
Now it’s your turn.
Anchor to Run itRun it
With Shopify AI Toolkit installed, ask your coding agent:
/shopify Check my app for common security vulnerabilities
This directs your agent to run shopify app security check using Shopify CLI. Run it directly to see the provided prompts and context.
And because your agent reads your code, the check isn’t tied to one framework. It supports both public and custom apps, whether you use React Router, Rails, Django, Laravel, or custom authentication, it examines how your app actually works and knows what gaps to look for.
Anchor to Fix what it findsFix what it finds
Each finding includes:
- The affected file and line
- The severity and why the issue matters
- A code example showing how to fix it and deep links to our documentation
Start with critical and high-severity findings. Work through them with your coding agent or fix them yourself, review the changes, and run the check again.
Make it part of every release. A clean report isn’t a guarantee of security: use it alongside your existing tools and reviews.
Anchor to Help make the tool betterHelp make the tool better
Security is a shared responsibility. We made the tool open source so Shopify and app developers can improve it together.
Share your feedback with us in the Forum, or contribute improvements directly through the open-source GitHub repository. Your feedback helps make future checks more useful for everyone.
Securing the ecosystem is a priority and one we will continue to invest in, including existing measures you can find here. If you haven't adopted these, now's the time.
Run the check on your app today, then fix what it finds to keep your app secured. Apps that keep up with security guidelines will be in the best position to protect merchants and their business. It’s essential that we prioritize this work together.