shopify app security check: put Shopify's app scanner in CI

Shopify's Fall '26 Edition made shopify app security check a headline developer feature, and every Shopify app team should wire it into CI this week. The command scans an app's source for Shopify-specific holes: unverified webhooks, queries not scoped to one shop, committed credentials and unauthenticated routes. One detail matters most: by default it never fails a build, whatever it finds.

What actually happened

Shopify first shipped the command in its AI Toolkit changelog in mid-October. It then featured it in the Fall '26 developer Edition on October 28, saying most of the partners who tested it found gaps they didn't know about. The changelog names gaps in authentication and in how merchant data was isolated across stores. Shopify gave no numbers.

From the CLI reference:

• Two layers. Run alone, it performs a deterministic scan and prints findings. With the AI Toolkit and a coding agent, the agent also reviews the checks that need judgment, using app security instructions.
• Severity: high ("fix before shipping"), medium and low.
• --blocking sets the lowest severity that returns a non-zero exit code. The default is none, so nothing fails.
• --include-dir adds a backend or shared library outside the app folder. --no-input turns off prompts for CI.
• Results go to .shopify/app-security/.
• Limits: some deterministic checks only support the React Router template; other frameworks rely on the agent review. Shopify says it checks source code only and should be one layer of your security.

The tool is open source. Shopify lists no pricing.

Why it matters for your business

If you have a custom or public Shopify app, cross-shop data access is the bug that ends the business. One query missing a shop filter, and Store A sees Store B's customers. That kind of bug passes every test that uses one dev store.

So the setup we'd use:

shopify app security check --no-input --blocking high --skip-instructions

Run it on every pull request. Block merges on high findings from day one. Fix the medium backlog, then tighten to --blocking medium.

Scan the whole backend. If your webhook handlers live in a separate service, add --include-dir. A scan that skips where the webhooks are verified proves nothing.

Not on React Router? Know what you're missing. On Rails, Django or Laravel, some checks need the agent pass. Run it before each release and review the agent's changes like any other pull request.

Add the gitignore rule. Keep .shopify/app-security/ out of the repo unless you want findings in history.

Sources: Shopify.dev: app security check CLI reference, Shopify.dev changelog: AI Toolkit security check, Shopify: Fall '26 Edition for developers.