Shopify AI Toolkit and Shopify CLI now have a new security check command. It scans your code, extension point configuration, and dependencies, then reports the affected location, severity, a suggested fix, and related documentation. It is open source.
shopify app security check .AI is speeding up development, but attackers are using the same tools to find and exploit security gaps faster and more cheaply.
It scans for the kinds of issues common in Shopify apps, finds problems in your own code, and even provides guidance on how to fix them.
shopify app security check to run it.Points to exactly where the issue is.
How serious it is, and why it's a problem.
Shows one way to fix it in code.
Links that explain the pattern and how to fix it.
| Item | What the article says |
|---|---|
| App types | Public Custom : both are supported |
| Frameworks | Framework-agnostic. Examples include React Router, Rails, Django, Laravel, and custom auth |
| Where it runs | Runs locally on your development machine |
| Distribution | Open source (published in a GitHub repository) |
| Pricing | Not stated |
Through your agent, or directly from the CLI.
Fix the highest-severity findings first.
Fix issues with your agent or on your own, and always review the diff.
Confirm the fix. Build it into every release.
Merchants trust apps with their orders, customer data, and revenue. Protecting that trust means keeping pace with evolving threats.
They uncovered issues they didn't know about — specifically,authentication gapsand gaps inmerchant data isolation across stores.
It complements Shopify's existing platform protections and developers' own reviews. The goal is to catch more issues earlier in development.
| What you might want to know | What the article says |
|---|---|
| List of detection rules | Not in the article (it points to the "Shopify app security checks" guide) |
| Severity levels | Critical and High are mentioned. Definitions for all levels aren't given |
| How to add it to CI | Not stated (only a recommendation to run it with every release) |
| Required CLI version | Not stated |
| Relationship to App Store review | It only says you can run it before submitting; whether it's required for review isn't stated |
| Pricing | Not stated |
Runs on your development machine. From the article, it doesn't appear to be built around sending your code to an external SaaS scanner (the article gives no details on where data is sent).
The agent reads your code and checks how the app actually behaves. It works outside the React Router template too (Rails / Django / Laravel / custom auth).
/shopify ... is just the entry point. Under the hood, it runs shopify app security check. Run it directly to see the prompt and context passed to the agent, which makes its behavior easier to audit.
The Partner examples highlighted "authentication gaps" and "gaps in data isolation between stores." If your app is multi-tenant, pay close attention to shop-scoped logic.
The rules are published on GitHub, so you can see exactly what's checked and contribute improvements. At the same time, the docs state plainly that "a clean report ≠safe" . Rather than replacing SAST, dependency scanning, or human review, it's best used asa layer that covers Shopify-specific patternson top of them.
shopify app security check as a required pre-submission step. Fix and re-run until there are zero Critical / High findings.