How to Check a Shopify App's Security Before You Install It

In October 2026 several Shopify apps were used to send shoppers to fake checkout pages. In each confirmed case, the attacker did not break Shopify. They got into the app developer’s side and changed what the app loaded on stores. Our summary of the October 2026 checkout hijack covers what happened.

You cannot audit an app developer’s servers. But you can judge how much an app can do on your store, keep that as small as possible, and notice quickly when something changes. This checklist is for merchants deciding what to install, and for the person who looks after the store’s apps.

Two kinds of risk

An app can reach your store in two different ways. They fail in different ways, so check both.

Admin access. When you install an app, it asks for permissions, called access scopes: read orders, write products, read customers and so on. With them, the app’s servers can read or change that data through Shopify’s API. A leaked app credential exposes what those scopes allow.

Storefront code. Many apps add something to your online store: an app embed, an app block, a script. That code runs in your shoppers’ browsers. If it is changed, it can change what shoppers see and where they are sent, including on the way to checkout. This is the path the October attack used.

Before you install

1. Read the permissions screen. Shopify shows the access the app asks for before you approve it. Ask whether each one matches the job. A size chart app has no obvious reason to read your customers or your orders.
2. Check whether it touches the storefront. Look at the listing and the app’s help pages. If it changes your product page, cart or pop-ups, it runs code on your store.
3. Look for “custom code” settings. Apps that let you paste your own JavaScript or HTML in their settings are flexible, but anyone who gets into that settings page, at your end or at the developer’s end, can run code on your storefront.
4. Look at the developer. Check the developer’s page in the App Store, how long the app has been listed, whether reviews mention support that answers, and whether there is a privacy policy and a contact address. A developer who publishes a security page or a way to report problems is a better sign than one who does not.
5. Prefer fewer apps. Each app adds its own servers, staff and passwords to your store’s attack surface.

After you install

1. Keep an app inventory. One line per app: what it does, who on your team owns it, when you last used it.
2. Uninstall what you no longer use. Removing an app revokes its access. Then open the theme editor and check that its app embed is gone too.
3. Protect the accounts around the app. Many apps have their own dashboard with its own login. Use a unique password and two-step authentication there, not only in Shopify.
4. Limit who can install apps. In Shopify, staff permissions decide who can add apps. Our guide to staff permissions shows how to set them.
5. Test your checkout regularly. Once a week, and after every app change, add a product in a private window and press Checkout. You should stay on your domain or Shopify’s checkout.
6. Watch for changes in theme code. Before and after installing an app, note which <script> tags your theme loads. A new domain you can’t explain is worth a question to the developer.

When an app is reported as compromised

• Do not wait for an official list. Run the checkout test now.
• Disable the app’s embed in the theme editor, or uninstall the app, until its developer confirms the fix.
• Take screenshots of anything suspicious before you change it, so the developer and Shopify can trace it.
• Ask the developer in writing whether your store was in scope and for which dates.
• If customers may have paid on a fake page, tell them so they can contact their bank.

When a custom app is the better choice

Sometimes a merchant installs three apps and pastes custom code into each to get one workflow. A small custom app, built for that job only, can be a safer route: it asks only for the scopes it needs, it has no shared settings panel used by thousands of stores, and you know who holds its credentials.

It is not automatically safer. A custom app needs the same care: credentials kept out of code, two-step authentication on its hosting, and someone who keeps it up to date. Our guide on when to build a custom Shopify app helps you decide.

Talk to us

The team behind StoreFleet, Shopify app developers since 2021, builds custom apps and reviews existing ones: which scopes they hold, how they load code on the storefront, and who can change it. Our post on custom options after the checkout hijack compares the routes we offer. The page on hiring Shopify app developers explains what we take on, and you can send a short brief from there.