Independent security testing · Shopify apps

Security testing for Shopify apps

Your app connects stores, APIs and merchant data. We help you understand where those connections could be exposed—and what to do about it.

Discuss your app Explore services
  • Fixed-scope pricing in USD
  • Written authorization first
  • Manual verification of every finding
Trust boundaries in a typical Shopify app Two merchant stores connect through OAuth to an app backend. The backend calls the Shopify API and receives webhooks. The tested boundaries are between stores, between the app and Shopify, and around the app's own infrastructure. MERCHANT STORES YOUR APP · IN SCOPE SHOPIFY Store Ashop-a.myshopify Store Bshop-b.myshopify OAuth · sessionstoken per store API · tenant datashop_id scoping Webhooks · proxyHMAC verified? AdminAPI Store B reads A's data?
Where a Shopify app usually breaks: the boundary between one store's data and another's.

01Scope

Built around Shopify app risks

Generic scans can miss how a Shopify app authenticates a store or separates one merchant’s data from another’s. Our assessments combine automated checks with manual testing of the workflows and integrations in your agreed scope.

  • Store isolation

    Test whether one store can access another store’s records or actions.

  • Authentication and access

    Review session handling, permissions and sensitive endpoints.

  • Shopify integrations

    Examine webhooks, app proxies and storefront components where applicable.

  • Infrastructure and secrets

    Check agreed public-facing services and exposed credentials.

Manual testing comes first, supported by established tools and our own AI-assisted analysis. Read about our tools and methodology.

02Services

Choose the right next step

Incident VAPT

Shopify App Incident VAPT

$3,500fixed scope

Test the app, organize incident evidence and document the next steps.

  • One app
  • Up to 30 agreed endpoints
  • Retest: One retest of confirmed findings within 30 days, with addendum
Learn about Incident VAPT

USD. Taxes, if applicable, are additional. Compare Shopify app security pricing.

03Incident response

Received a security request from Shopify?

If Shopify has asked for an incident report or independent VAPT, we can help you define the testing scope, prepare an incident report draft from your records and verify agreed fixes. We will make clear what the evidence establishes and what remains unknown.

Discuss your incident About Incident VAPT

04Process

How an assessment works

  1. 01

    Define the scope

    Agree the app, environments, access, timing and rules of engagement.

  2. 02

    Test and validate

    Review the agreed attack surface and manually verify relevant findings.

  3. 03

    Report and remediate

    Receive clear evidence and recommendations for your team.

  4. 04

    Retest where included

    Verify the agreed fixes and document the results.

05Principles

Independent, focused and practical

Our assessments focus on the app and assets you operate. Every engagement starts with written authorization and a defined scope. Results describe what was tested and what could not be tested; no assessment can prove that an application has no vulnerabilities.

We pair experienced manual testing with our own AI-assisted analysis tooling to cover Shopify-specific patterns more consistently. Automation helps us look in the right places; people confirm what is real.

  • Written authorization and asset list before any testing
  • Test stores with synthetic data preferred
  • Payments, data deletion, DoS and mass messaging excluded by default
  • Clear statement of coverage and limitations in every report

Tell us what you need to assess

Share the scope and any deadline. We’ll discuss the right engagement before work begins.

Contact us