Apps / Security / Call to developers

Securing your app, together
8 app security steps to take "this week"

AI is making vulnerabilities easier to find, and attacks are increasing across the app ecosystem. Shopify is asking every app developer to make security their top priority and take action this week. Shopify will also tighten restrictions on the platform side.

On this page
  1. What's happening (in 30 seconds)
  2. 8 actions developers should take this week
  3. Coverage map of the actions
  4. 3 measures Shopify is strengthening
  5. How to report a security issue
  6. What the article covers / doesn't cover
  7. 5 key points for engineers
  8. 3 practical use cases
  9. One-line summary for proposals

1What's happening

Merchants install an app because theytrustboth the app and the Shopify App Store. Some attackers try to exploit that trust.
Because AI makes vulnerabilities easier to find, the app ecosystem, like the industry as a whole, is seeinga rise in attacks.
Shopify says "security is the most important work right now" and is asking all app developers to actthis week.

Trust comes first

Apps are chosen because merchants trust both the app itself and the App Store.

Attacks are rising

AI makes vulnerabilities easier to find, and attacks are increasing across the app ecosystem.

Act this week

All app developers are asked to complete the items below this week.

28 actions developers should take this week

1
AI

Scan with the new security check

Give AI Toolkit a single prompt to check for Shopify-specific vulnerabilities such as unauthenticated routes, cross-shop data access, and unverified webhooks. During early access, it found issues most partners hadn't noticed.

2

Migrate to expiring access tokens

Short-lived tokens limit the damage if they leak. They will soon be required for all public apps, so start migrating now.

3

Check every endpoint with a vulnerability scanner

Use a vulnerability scanner to confirm that every endpoint in your app is protected.

4
</>

Treat all rendered data as untrusted

Treat any data you render as untrusted, whether it comes from metafields or your own servers, and properly escape and sanitize input.

5

Review API requests in the Dev Dashboard

Look for suspicious activity. Start by filtering logs by client IP, then use traffic patterns to spot suspicious sources.

6
2FA

Secure every account tied to your app

Enable two-factor authentication on your Partner account, hosting, CDN, code repositories, and email. Remove access for anyone who no longer needs it.

7
!

Keep your emergency contact up to date

Make sure the emergency developer email registered in the Partner Dashboard reaches someone who can act right away.

8

Review and apply best practices

Revisit the security best practices in Shopify Dev Docs and apply them to your app.

Expiring access tokens will be "required for all public apps soon". Of the 8 items, this is the only one announced as becoming mandatory. No specific deadline is given.

3Map of what each action covers

People & accounts ⑥ Two-factor auth & access cleanup ⑦ Update emergency contact Partner / hosting / CDN / repositories / email App code ① Check with AI Toolkit ③ Scan all endpoints ④ Escape / sanitize ⑧ Full review against best practices Credentials ② Expiring access tokens Limit damage if leaked Soon required for all public apps Monitoring ⑤ Dev Dashboard API logs Filter by client IP to find suspicious sources
The four categories in the diagram are this explainer's own grouping (the original article simply lists 8 items). Beyond code alone, itaddresses people & accounts and monitoring as well, which is what sets this call to action apart.

43 hardening measures Shopify is rolling out

Storefront

Tighter boundaries for app code on the storefront

Shopify is tightening the boundaries (the scope of what it can do) for app code running on the storefront.

IP Credentials

IP address restrictions

Keyscan only be used from your own servers— add IP address restrictions so this is enforced.

App Store

Stricter App Store security requirements

Security requirements for apps listed on the App Store will be tightened.

Changes and their timelines will be announced in advance, before they take effect— Shopify has said this explicitly, so there will be time to prepare. Shopify will also keep investing in platform protections, developer tools, and guidance so that secure development becomes the default.

5Escalation flow when a security issue occurs

?! Suspected issue App developer Immediately Contact Shopify partner-security-reports @shopify.com Report at the suspicion stage Developer's responsibility (with Shopify's support) 1. Fix the issue 2. Notify affected merchants Developers are responsible for the response
Type of inquiryContact
Suspected app security issueImmediately partner-security-reports@shopify.com
General security questionsStandard Shopify Support

6What the article does and doesn't say

ItemWhat the article says
Deadline for developersThis week Developers are asked to complete the 8 items this week
Expiring tokens becoming mandatoryAnnounced Will soon be required for all public apps.No specific date given
Storefront boundaries, IP restrictions, App Store requirementsAdvance notice Details and timelines will be announced before they take effect.No details available yet
Items checked by AI ToolkitUnauthenticated routes, cross-shop data access, unverified webhooks, and more
Details on how to use AI ToolkitIt only says "check with a single prompt." The specific prompt and setup areNot specified
Consequences for violationsNot specified

75 key points for engineers

1. Migrate to expiring tokens before they become mandatory

Shopify has announced they will soon be required for all public apps. Because you'll need to rework how tokens are stored and refreshed, it's safer to start migrating before a deadline is announced.

2. Close the three Shopify-specific gaps first

The examples AI Toolkit gives areunauthenticated routes,cross-shop data access,unverified webhooks. All are classic problems in multi-tenant apps.

escape

3. Don't trust data from your own server either

Not just metafields, butdata returned from your own servershould also be treated as untrusted, as explicitly stated. Escape and sanitize everywhere it's rendered.

IP

4. Inventory your server setup ahead of IP restrictions

Keys will soon be usable only from your own servers. Identifying now which source IPs call the Shopify API lets you respond quickly when guidance arrives (spec details not provided).

2FA

5. Protect paths beyond your code

Two-factor authentication is called for across your Partner account, hosting, CDN, code repository, and even email.If any one of them is compromised, your app could be tampered with, so review access, including removing permissions for former employees and contractors.

83 practical use cases for your business

USE CASE 1

A "security sweep this week" for your in-house apps

Challenge
You run multiple public or custom apps, but security reviews depend on specific individuals and you can't tell how much has been addressed.
Approach
Turn the 8 items directly into a checklist and assign an owner for each app. Start by running AI Toolkit's security check and the vulnerability scanner, then fix whatever they find.
Impact
Complete a review aligned with Shopify's expected standards in a short time, and catch vulnerabilities you'd missed more easily.
Technical note
Filter Dev Dashboard API logs by client IP to check for requests from anywhere other than your own servers.
USE CASE 2

A planned migration to expiring tokens ahead of the requirement

Challenge
Your implementation still assumes non-expiring tokens. Rushing to rework it after a deadline is announced will strain both quality and schedule.
Approach
Identify everywhere tokens are stored and used, and plan the migration to expiring tokens ahead of schedule. At the same time, document the IPs of servers that call the API to prepare for upcoming IP restrictions.
Impact
If a token leaks, the damage is limited, and you'll have time to spare when the requirement becomes mandatory.
Technical notes
The article doesn't cover specific migration steps, deadlines, or how IP restrictions will work. Check Shopify Dev Docs and upcoming announcements.
! 2FA
USE CASE 3

Set up incident response and "account hygiene"

Problem
The emergency contact in the Partner Dashboard still points to a former employee or an unused email, and outside contractors still hold outdated permissions.
Action
Change the emergency contact to an address the on-call person monitors. Require two-factor authentication across Partner, hosting, CDN, repository, and email accounts, and remove unnecessary permissions. Document a procedure to contact partner-security-reports@shopify.com immediately when you suspect an issue and to notify affected merchants.
Impact
Attacks that start with an account takeover become easier to prevent, and you can respond faster when something goes wrong.
Technical notes
Fixing issues and notifying affected merchants is the developer's responsibility (Shopify plays a supporting role). Having a notification template ready is a good idea.

9One-line summary for proposals

"With AI driving more attacks, Shopify is asking every app developer to completea full security review this week.
Scanning with AI Toolkit, moving to expiring tokens, and two-factor authenticationare the core pillars, and
IP restrictions and stricter App Store requirements are coming next. Get ahead of them now."