Shopify App Security Testing & Penetration Testing — Farchase
Farchase logoFarchase ← All Services Book a Security Call
Home/ Services/ Shopify App Security
ShopifyFor Shopify app developers & partners

Shopify App Security Testing

Protect your Shopify app before a vulnerability becomes a merchant security incident.

Farchase manually tests Shopify applications, APIs, integrations, authentication flows, merchant-facing features and business logic, so vulnerabilities are found before they affect merchants, their customers, or your Shopify App Store presence.

32+ Shopify apps tested
Manual-first testing
API & business logic
Retesting included
Incident & final reports
Testing certificate
Shopify App · Attack Surface Map TESTING
Merchants
Store A
owner · staff
Store B
owner · staff
Attacker store
tries cross-tenant
Your app
Embedded admin UI
App backend & API
OAuth · tokens · webhooks
Data reached
Products · orders
Customers · discounts
Themes · settings
CRIT Store B settings editable from Store A session Retest ✓
HIGH Paid-plan feature reachable on free plan Open
Shopify app teams we've tested for
Aaaecommerce
GetWiser
Minimate Apps
CWILL
Why Shopify app security matters

Your app holds the keys to many merchants' stores at once

Every install grants your app access to a merchant's store through OAuth scopes and access tokens. Your backend usually serves all of those merchants from one codebase and one database.

If tenant isolation or authorization is wrong in one place, data and functionality can be exposed or changed across merchant accounts.

Shared responsibility

Shopify secures its own platform. Your app's backend, APIs, authorization logic, data storage and third-party integrations are yours to secure. Building on Shopify does not make them secure automatically.

Sensitive areas a typical Shopify app touches
Merchant accounts Store configuration Products Orders Customers Discounts Themes Files Analytics Billing Shopify APIs OAuth & access tokens Webhooks Admin interfaces Third-party integrations
What can happen

A Shopify app vulnerability can become more than a bug

How a single flaw can move from your code to merchants, their customers and your business.

01
Vulnerability exists
02
Attacker discovers it
03
Unauthorized access, data change or account abuse
04
Merchant or customer impact
05
Investigation & emergency remediation
06
Possible Shopify review or compliance action
07
Business, reputation & revenue impact
Technical impact
  • Access to another merchant's resources
  • Manipulated app configuration
  • Exposed merchant or customer information
  • Unauthorized modification or deletion of data
  • Abuse of privileged functionality
  • Account takeover scenarios
  • Malicious content injection into storefronts
Business impact
  • Damage across multiple merchant tenants
  • Emergency remediation work
  • Merchant complaints and support load
  • Loss of merchant trust and reviews
  • App review or compliance scrutiny
  • Possible App Store enforcement, depending on the circumstances
Shopify's security expectations

What happens if Shopify identifies a security problem?

App Store apps must comply with Shopify's Partner Program Agreement, API License and Terms of Use, and App Store requirements. Shopify states that developers are responsible for keeping their apps compliant as requirements change. The response to a problem depends on what the issue is and which policy applies.

DURING REVIEW
Rejection

The App Review team can reject a submission that doesn't meet its standards. Issues usually need fixing before the app can be published.

LIVE APP
Remediation request

Shopify notifies Partners by email when action is required, including critical fixes sent to the emergency developer contact, with a stated timeframe.

LISTING
Unavailable or delisted

Shopify says violating its Partner Program terms can lead to an app being removed from the App Store. Visibility can stay affected even after an issue is resolved.

ACCOUNT
Partner enforcement

Shopify may restrict a Partner's use of its services or affect eligibility for programs such as Built for Shopify, calibrated to the violation.

Not every vulnerability leads to delisting. Sources: Shopify App Store requirements, Shopify App Store policy violations, and Enforcement of Shopify's Partner Program Policies (shopify.dev, help.shopify.com). Shopify enforcement decisions are made solely by Shopify. Farchase does not control or guarantee Shopify review, approval, relisting, delisting or enforcement outcomes.

Before an incident

Find the vulnerability before an attacker does

1
Scope review
Architecture, APIs, roles, merchant workflows, integrations and sensitive functions.
2
Test accounts
Multiple authorized stores and roles to check tenant and authorization boundaries.
3
Manual testing
Researchers test the app by hand, not only with automated scanners.
4
Business logic
How workflows can be manipulated in ways scanners don't see.
5
Cross-merchant authorization
Can one merchant read or change another merchant's resources?
6
API security
Authentication, authorization, input validation and sensitive operations.
7
Exploit validation
Each potential issue is confirmed before reporting to cut false positives.
8
Reporting
Detailed, reproducible findings with evidence.
9
Remediation support
We work with your developers to understand and fix each issue.
10
Retesting
Fixes are verified after you deploy them.
What we test

Shopify app security testing matrix

Only authorized testing within the agreed scope.

Authentication & account security

Authentication flowsOAuth implementationSession managementToken handlingPassword resetAccount takeover

Authorization & tenant isolation

Cross-merchant accessCross-user accessObject-level authorizationRole-based accessPrivilege escalationAdmin functionsStore isolation

Shopify API security

Shopify API integrationsApp APIsGraphQL endpointsREST endpointsAPI authorizationSensitive operationsInput validationToken exposure

Application security

Stored & reflected XSSHTML injectionSQL injectionSSRFFile uploadCSRFOpen redirectsMisconfigurationInformation disclosure

Business logic security

Feature restriction bypassPlan / subscription bypassDiscount manipulationWorkflow manipulationUnauthorized config changesSensitive action abuseRace conditions (safely)
Shopify

Shopify-specific workflows

Products & ordersDiscountsCustomersTheme / app configBundles & recommendationsCampaigns & analyticsStaff managementInstall & auth flowsWebhooks
Shopify incident response

Already had a security incident?

If you've received a vulnerability report, a merchant complaint or a Shopify security notification, or found unauthorized activity, we validate the issue and document the work in a structured report.

1
Incident received
2
Vulnerability validation
3
Impact & affected components
4
Root cause analysis
5
Remediation guidance
6
Fix verification
7
Incident Response Report
8
Final security assessment
FARCHASE · CONFIDENTIAL
Incident Response Report
Sample layout · client details redacted
Severity
Critical
Status
Remediated · verified
Report contents
· Incident overview· Vulnerability details· Affected functionality· Security impact· Root cause· Investigation method· Remediation performed· Verification & retest· Preventive measures· Timeline

Reports document only what the evidence supports. Farchase cannot guarantee Shopify will accept an IR report.

FINDING F-03
Cross-merchant settings update
CVSS 9.1CWE-639
POST /api/settings
store_id: [other-store]
→ 200 OK
FARCHASE
Shopify App Security Assessment
Final report · sample
EXECUTIVE SUMMARY
1
CRIT
3
HIGH
4
MED
2
LOW
F-01 OAuth state not validatedRemediated
F-02 Plan limit bypassPartially fixed
F-03 Cross-merchant updateRemediated
F-04 Stored XSS in widgetOpen
Final security assessment report

A report your developers and leadership can both use

Every assessment ends with a professional report. The mockup shows sample data only.

✓ Executive summary✓ Scope & assessment dates✓ Testing methodology✓ Severity classification✓ CVSS scores where applicable✓ CWE mapping✓ Business & technical impact✓ Reproduction steps✓ Proof of Concept✓ Affected endpoints✓ Remediation recommendations✓ Retest status✓ Final posture summary
Real Shopify engagements · redacted

See the reports we actually deliver

Two client-ready reports from Shopify app engagements, with client names, domains and evidence redacted.

ORIGINAL SEVERITY · CRITICAL PATCHED / REMEDIATED

Incident Response & Compromise Assessment

A Shopify app where an executable PHP upload led to a full compromise chain. Shopify separately flagged roughly 906 anomalous script-tag modification requests from many external IPs.

CONFIRMED COMPROMISE CHAIN
PHP upload accepted→Web file manager→config.php read→DB credentials→Table export→Shopify token exposure
12-PAGE REPORT · SECTIONS
01Executive summary
02Incident scope & evidence
03Attacker execution walkthrough
04Confirmed compromise chain
05Attacker-used artifacts
06Shopify token exposure assessment
07Shopify detection & indicators of compromise
08Incident timeline
09Containment, eradication & recovery
10Root cause & remediation validation
11Final assessment
View redacted IR report (PDF) →
OVERALL STATUS · PASS RETEST

Penetration Test Patch & Retest Report

The retest of a Shopify announcement and push app after remediation: every original finding re-exploited, plus an expanded 105-check sweep.

25/25
findings patched
105
security checks
0
open
ORIGINAL FINDINGS · EXCERPT
CRITICALLogin to another shop via shop parameterPATCHED / PASS
HIGHIDOR: modify another merchant’s announcement barPATCHED / PASS
HIGHIDOR: create bars inside a victim shopPATCHED / PASS
HIGHPHP file accepted as background imagePATCHED / PASS
HIGHStored XSS in bar name on dashboardPATCHED / PASS
MEDIUMCSRF on push widget settingsPATCHED / PASS
MEDIUMOpen redirect via shop parameterPATCHED / PASS
+ 18 more · 105 checks across tenant isolation, auth, business logic, API, CSRF, uploads, CORS and rate limiting
View redacted patch report (PDF) →
From vulnerability to verified fix

Finding the bug is only part of the job

Discover→ Validate→ Report→ Fix→ Retest→ Verify→ Final report

Retesting

After your team deploys fixes, we retest the affected functionality to confirm the issue is remediated and check for obvious bypasses. Nothing is marked fixed until it has been verified.

Opennot yet fixed
Partially fixedbypass remains
Remediatedverified by retest

Security completion certificate

After the agreed assessment and retest, we issue a Penetration Testing Completion Certificate. It confirms the defined assessment was completed and records the assessment and retest status as of that date. It is not a guarantee that the app is free of vulnerabilities.

CERTIFICATE OF COMPLETION
Shopify App Security Assessment
[App name] · Assessment completed [date] · Retest status recorded
EMERGENCY SUPPORT

Emergency Shopify security support

For situations that can't wait:

· Shopify security notification· Vulnerability disclosure· Researcher security report· Merchant security complaint· Suspected unauthorized access· Critical vulnerability· App unavailable over a security concern· Rapid security validation· Structured IR report· Remediation verification
Request Emergency Security Review
Removed or delisted

Has your Shopify app been removed or delisted?

We independently assess the app's security, document remediation, retest, and prepare technical documentation that can help you show the work completed.

  1. Review Shopify's notification
  2. Review application security
  3. Reproduce the issue (authorized)
  4. Identify root cause
  5. Remediation guidance
  6. Verify developer fixes
  7. Broader testing where needed
  8. IR / security documentation
  9. Final assessment report
  10. Retest evidence
Farchase can provide the independent security assessment, remediation verification, and supporting documentation. Shopify alone determines App Store review and enforcement outcomes.
Engagement options

One-time and continuous security testing

One-time Shopify app pentest

New apps, pre-release, major features, preparing for external review, or apps without recent manual testing.

✓ Full manual assessment✓ Security report✓ Remediation guidance✓ Retest✓ Final report✓ Completion certificate

Continuous Shopify app security

ONGOING

For apps that ship features regularly.

✓ Periodic manual testing✓ Testing of newly released features✓ Authorization & business-logic testing✓ API testing✓ Vulnerability tracking & retesting✓ Updated security reporting
Farchase Pentest Portal

Track every finding in one place

Your team manages vulnerabilities through the Farchase Pentest Portal.

· View vulnerabilities· Review severity· Reproduction details· Track remediation· Discuss findings· Follow retest status· Keep assessment records
pentest.farchase.com →
Why Farchase

Built around how Shopify apps actually work

32+ Shopify apps tested Manual-first Business-logic focus Cross-merchant authorization API security Validated exploits Developer-focused reports Remediation support Retesting IR documentation Final reports Pentest Portal Continuous testing
Comparison

Automated scan vs. Farchase Shopify app testing

Scanners are useful for broad coverage and we use them alongside manual work. They can't reason about cross-merchant authorization or business logic.

Basic automated scan
Farchase Shopify app testing
Scanner-driven
Manual-first
Generic checks
Shopify workflow testing
Limited authorization testing
Cross-merchant & cross-account testing
Limited business-logic analysis
Manual business-logic testing
Raw scanner output
Validated vulnerabilities
Generic remediation
Developer-focused guidance
Usually no retesting
Retesting included
No incident documentation
IR + final report available
FAQ

Shopify app security questions

{{ f.q }}+

{{ f.a }}

Test your Shopify app before someone else does

Manual testing of cross-merchant authorization, OAuth, APIs and business logic, with verified fixes and a final report.