StoreFleet Services

Shopify app security review

Know what every app on your store can reach, and what it runs

Every app you install can reach your store data, your storefront or both. We review the apps and scripts your store runs, replace the risky parts with code you own, and check every day that nothing changed without you.

Ask for a review What the review covers

Checked daily
the purchase path
Checked daily
what loads on the storefront
Checked daily
who has access
Checked daily
the app itself

Two kinds of risk

An app reaches your store in two ways

They fail in different ways, so a review checks both.

Admin access
When you install an app, it asks for access scopes: read orders, write products, read customers. With them, the app's servers can read or change that data through Shopify's API. A leaked app credential exposes what those scopes allow.
Storefront code
Many apps add an app embed, an app block or a script to your online store. That code runs in your shoppers' browsers. If it is changed, it can change what shoppers see and where they are sent, including on the way to checkout.

Where we look first

Not every app needs replacing

Start with the parts where a change can hurt shoppers or your data.

  1. Anything on the way to checkout

    Cart drawers, upsells, product options and anything that touches the checkout button.

  2. Apps with a custom code field

    If a setting accepts JavaScript or HTML, whoever reaches that setting can run code on your storefront.

  3. Scripts pasted into the theme

    Tracking snippets and widgets added years ago, often by someone who has since left.

  4. Integrations with write access

    Anything that can change prices, stock or orders, such as an ERP sync or a feed tool.

  5. Custom apps nobody maintains

    Old API versions, unverified webhooks and credentials still held by a former freelancer.

What the review covers, for each app

  1. Scopes

    Which access scopes each app holds, and whether its job needs them.

  2. Storefront code

    Whether it loads code on the storefront, and from where.

  3. Code fields

    Whether it has settings that accept JavaScript or HTML, and who can edit them.

  4. Outside accounts

    Which accounts outside Shopify control it, and whether they use two-step authentication.

After the review

Three ways to cut the risk you found. You can pick one, or move from one to the next.

A custom app that replaces the risky part

Best when one workflow depends on an app's custom code field, or on several apps glued together with scripts.

We build a small app for your store only. Its storefront part ships as a theme app extension: the code is reviewed, versioned and deployed with the app, not typed into a settings field and fetched at runtime. It asks only for the scopes your job needs, and you decide who holds its credentials. It still needs secure hosting, two-step authentication on every account around it, and someone who keeps it up to date.

Move the logic off the storefront

Best when the logic is about discounts, shipping, payments or checkout fields.

Shopify Functions run discount, shipping and payment logic on Shopify's own infrastructure instead of in the shopper's browser. Checkout UI extensions add fields and messages in Shopify's sandbox and cannot rewrite the page or send the shopper elsewhere. Web pixels handle tracking in a sandbox too, instead of a script tag with full access to the page. Some of these depend on your Shopify plan.

Ongoing upkeep by the month

Best when you already run a custom app or integration and nobody owns it day to day.

Fixes, new features, Shopify API version upgrades and monitoring, plus testing the purchase path after each app or theme change, reviewing new scripts before they go live, and checking who still has access.

Daily upkeep

What the daily checks cover

For stores that want someone to own these parts after the review.

The purchase path
An automated run adds a product and presses Checkout, and alerts when the shopper does not reach your domain or Shopify's checkout.
What loads on the storefront
Scripts, app embeds and the domains they call, compared with the day before. A new domain gets a question the same day.
Who has access
New staff accounts, collaborator requests and newly installed apps.
The app itself
Errors in the logs, webhook failures, dependency security alerts and Shopify API versions nearing their end of support.

Questions, answered

What do we get from a review?

A written list of the apps and scripts your store runs, what access each one holds, what code it runs on the storefront and from where, who can change it, and what we would change first. Nothing on your live store changes until you approve it.

Do you need access to our store?

Yes, as a collaborator. Shopify's collaborator accounts let the store owner choose which sections we can open, and the owner can remove the access at any time. We never ask for your password.

Will you tell us whether a specific app was compromised?

We tell you what an app can reach and what it runs on your store. Whether a vendor was breached is for that vendor and Shopify to confirm; until they do, we treat a report as a reason to test the checkout and disable the app's embed, not as a verdict.

Does a custom app make the store secure?

It removes some paths, such as code typed into a shared settings field and fetched at runtime, and it asks only for the scopes your job needs. It does not remove the need for care: secure hosting, two-step authentication on every account around it, and someone who keeps it up to date.

What does it cost?

It depends on how many apps and scripts the store runs and on whether you want a one-off review or daily upkeep, so we reply to each brief with an approach and an estimate.

How do I start?

Email hello@reply.getstorefleet.com with the store, what made you ask and who changes the store today. The email opens with those questions filled in. We reply with how we would approach it.

Read more on the blog

  1. How to Check a Shopify App's Security Before You Install It

    Every app you install can reach your store data or your storefront. A practical checklist to judge an app's risk before installing it and to keep it in check after.

    · 4 min read

  2. Hire a Developer for the Risky Parts of Your Shopify Store

    Custom Shopify apps are quicker to build than they were. Why hiring a developer to own the parts of your store attackers target, with daily checks, can pay off.

    · 4 min read

  3. Safer Than Another App? Custom Options After the Checkout Hijack

    After apps were used to hijack Shopify checkouts, four custom routes to cut that risk: an app review, a custom app with no remote code, Functions, and upkeep.

    · 4 min read

  4. Shopify Checkout Hijack Through Apps (Oct 2026): What to Check

    Compromised third-party apps sent some Shopify shoppers to fake checkout pages in October 2026. What happened, which apps confirmed it, and what to check today.

    · 6 min read

Have the risky parts of your store looked at

Tell us which store, what made you ask and who changes it today.

Email us

or write to hello@reply.getstorefleet.com. We reply with how we would approach it.