Launch Your Shopify Store with Confidence: A Guide to App Security

Embedded apps run inside the Shopify admin, log in with session tokens and react to webhooks. That means they trust input from the merchant, from Shopify and from shoppers at the same time. Most real-world problems come from skipping a check that Shopify already gives you tools for.

1. Session tokens that are decoded but not verified Your frontend sends a session token (JWT) with each request. If your backend only reads the shop name from it without validating the signature, anyone can forge a token. Fix: Verify the signature with your app secret and check expiry before trusting anything inside the token. Quick audit: Search your code for every place a JWT is decoded and confirm each one is a verifying call.
   
   

2. Webhooks accepted without signature checks Shopify signs each webhook. If your endpoint skips the check, attackers can send fake order or “app uninstalled” events that corrupt data or even trigger data deletion. Fix: Recompute the HMAC from the raw request body using your app secret and compare it with the header using a timing-safe comparison. Don’t use the parsed JSON, because re-serializing changes the bytes. Quick audit: Make sure no middleware parses the body before your webhook route computes the HMAC.
   
   

3. Weak install/OAuth flow The install flow is a classic target for request forgery. Three things must be validated on the callback: the state value matches what you generated, the hmac parameter is valid, and the shop parameter is a genuine .myshopify.com domain. Fix: Generate and store a random state before redirecting, reject mismatches, and check the shop format before using it in a redirect or database query. Quick audit: Follow your callback handler step by step and look for any value used before it is validated.
   
   

4. Weak framing rules (clickjacking) Embedded apps must be framed by the Shopify admin, but only by it. A wrong or wildcard frame-ancestors policy lets malicious pages embed your app and trick merchants into clicking. Fix: Set Content Security Policy frame-ancestors dynamically to the requesting shop and the Shopify admin only. Quick audit: Inspect the headers your production app actually sends, not just your config files.
   
   

5. Stored XSS from merchant or customer input Labels, notes, custom fields, translations and metafields can all carry malicious HTML. If you render them without escaping, the script runs in the admin or on the storefront. A reported 2026 case involved malicious code disguised as an image element in a translation field that accepted HTML. Fix: Escape output based on where it appears. Let your framework escape by default, avoid raw-HTML rendering, and sanitize with a trusted library when HTML is truly needed. Input filtering helps, but output encoding is what actually stops execution. Quick audit: Search for raw-HTML rendering and unescaped template output.
   
   

6. IDOR (data crossing between shops) If a query finds a record only by its ID, shop A can read shop B’s data by changing the ID. Fix: Include the shop from the verified session in every query filter. Never take the shop identifier from request params or body. Quick audit: Review each data-access query for a tenant filter.
   
   

7. Leaked secrets and tokens API secrets and access tokens often leak through git history, logs, error messages or frontend bundles. One leaked offline token can mean long-term access to a store. Fix: Store secrets in environment variables or a secrets manager, strip tokens from logs and client-facing errors, use expiring tokens, request minimum scopes, and rotate credentials after any suspected exposure. Quick audit: Run a secret scanner on your repository history and inspect your built frontend files.