Shopify announced it on 15 October as part of its AI Toolkit. I've read the announcement and the docs properly, so here's what it does, how to run it, and the bit Shopify is honest enough to say out loud: it won't catch everything.

What it actually is

It's a command that scans your app for common security problems before you ship. Each finding tells you the file and line, how serious it is and why, shows an example fix, and links to Shopify's guidance on the pattern.

There are two halves to it. The first is a deterministic scan that runs locally on your machine and answers questions with clear yes or no answers. Is there a secret committed to the repo? Is there a known vulnerable dependency? Are you still on an end-of-life API version?

The second half is handed to a coding agent. Some questions can't be settled by pattern matching. The docs give the example of whether a database query is scoped to a single shop. Answering that means reading and understanding the code, so the CLI gives your agent a set of instructions and the agent does the investigating.

The docs list 36 checks in total. 25 are rated high severity, 9 medium and 2 low. Among them:

  • Secrets and credentials: committed secrets or .env files, and credentials ending up in logs or the browser.
  • Injection: SQL injection, cross-site scripting, and unsafe output in Liquid and theme settings.
  • Authentication: missing authorisation checks, unauthenticated endpoints, CSRF and app proxy signature checks.
  • Shop scoping: database queries that aren't limited to the shop making the request.
  • Housekeeping: over-requested access scopes, missing GDPR webhooks, deprecated ScriptTag usage and old API versions.

That shop scoping one deserves a moment. If your app serves more than one store, a query that forgets to filter by shop can show one merchant another merchant's data. Shopify mentions partners reporting gaps in how merchant data was isolated across stores. It's a very easy mistake to make, and a very bad one to ship.

How to run it

If you've got the Shopify AI Toolkit installed in your coding agent, you ask the agent to check your app for security vulnerabilities and it runs the command for you, investigates, and walks you through what it found.

Without an agent you can still run shopify app security check yourself from the app's folder. You'll get the deterministic scan, and the command offers to copy or print the agent instructions so you can hand them to whichever tool you use. Results are saved under .shopify/app-security/ in your project.

Shopify's advice is to fix the critical and high findings first, review the changes, then run it again. And to run it on every release, not just once. I'd agree with that. A check you ran in March tells you nothing about the code someone changed in October.

The limits, in Shopify's own words

This is the bit I like. Shopify doesn't oversell it. The announcement says plainly: "A clean report isn't a guarantee of security."

A few things to keep in mind:

  • It looks for common patterns. It's built around the mistakes that turn up most in Shopify apps. Your app's own business logic, the rules about who can see or change what, is yours to check.
  • Some checks are template-specific. The docs say some of the deterministic checks only apply to apps built on the React Router app template. If your app is Laravel, Rails or something home grown, more of the work falls to the agent review.
  • Half of it is an AI reviewing code. That's genuinely useful, but it's the same kind of tool that may have written the code in the first place. It's worth having a person read the findings and the fixes before anything goes live.
  • It's about the app, not the whole setup. Hosting, server patching, who has the admin login, and how backups are handled all sit outside it.

None of that is a criticism. A free, open-source check that points at the right file and line is a big step up from no check at all. It's just not the same thing as a review.

Who should bother

If you sell an app on the Shopify App Store, you'll want this in your release routine anyway. But I think it matters more for the people who don't think of themselves as app developers.

Plenty of shops have a custom app quietly doing something important. Syncing stock with a warehouse, pushing orders into an ERP, handling trade pricing. It might have been written by a freelancer who's moved on, or built over a few weekends with Cursor or Claude. It works, nobody has touched it in a year, and it holds an access token to your store.

That's exactly the sort of app this check was made for. If you have one of those, here's what I'd do:

  • Find out where the code lives and who has access to it. If nobody knows, that's your first job.
  • Get whoever looks after it to run the check and send you the findings, high severity first.
  • Look at the access scopes. If the app only reads orders, it shouldn't have write access to them. The check flags over-requested scopes too.
  • Put a rerun on the list for every change, not just this one.

Where we come in

If you'd rather someone else did it, that's what we're here for. We build and look after custom Shopify apps and integrations, and our AI code audit covers the things an automated check can't, such as whether the logic behind your app actually makes sense, in a plain-English report within five working days. If you'd just like someone keeping an eye on it every month, have a look at our support and maintenance plans.

Either way, run the check. It's free, it's quick, and the worst it can do is tell you something you'd rather know now than later.

Cheers, Rob