Custom apps4 min read
Safer Than Another App? Custom Options After the Checkout Hijack
After apps were used to hijack Shopify checkouts, four custom routes to cut that risk: an app review, a custom app with no remote code, Functions, and upkeep.
In this guide
The October 2026 checkout hijack went through apps that load code on the storefront from their developer’s servers. Our summary of what happened covers the details, and our checklist for judging an app covers what any merchant can check alone.
Some stores need more than a checklist. They rely on an app with a custom code field, or on three apps patched together with scripts, or on a custom app nobody has looked at in two years. This post lays out the routes we offer for those stores, from the lightest to the most involved. Most stores need only one or two of them.
Option 1: A review of the apps you already run
Best when: you want to know where you stand before changing anything.
We go through your installed apps and your theme with you and write down, for each app:
- which access scopes it holds and whether the job needs them;
- whether it loads code on the storefront, and from where;
- whether it has settings that accept JavaScript or HTML, and who can edit them;
- which accounts outside Shopify control it, and whether they use two-step authentication.
You get a written list: what is fine, what is at risk, and what we would change first. If you have a custom app, the review also covers its code, where it is hosted, who holds its credentials, its API version and its webhooks. Often the outcome is simply “remove these two apps and move this script into the theme”, with no build at all.
Option 2: A custom app that replaces the risky part
Best when: one workflow depends on an app’s custom code field, or on several apps glued together with scripts.
Instead of a general app that thousands of stores configure through one shared panel, we build a small app for your store only. Its storefront part ships as a theme app extension: the code is reviewed, versioned and deployed with the app, not typed into a settings field and fetched at runtime. It asks only for the scopes your job needs, and you decide who holds its credentials.
That removes the exact path the October attack used. It does not remove the need for care: the app still needs secure hosting, two-step authentication on every account around it, and someone who keeps it up to date. Our guide on custom app versus public app compares the two in more depth.
Option 3: Move the logic off the storefront
Best when: the custom code exists to change prices, discounts, shipping or payment options, or what happens in checkout.
A lot of storefront scripts try to do work that Shopify now offers a safer place for:
- Shopify Functions run discount, shipping and payment logic on Shopify’s own infrastructure, compiled to WebAssembly, instead of in the shopper’s browser.
- Checkout UI extensions add fields and messages to checkout. They run in Shopify’s sandbox and cannot rewrite the page or send the shopper elsewhere.
- Web pixels handle tracking in a sandbox too, instead of a script tag with full access to the page.
Moving logic there means less code running freely in your shoppers’ browsers, which leaves an attacker less to change. Check your plan first: only Shopify Plus stores can use a custom app that contains Functions, and checkout UI extensions on the information, shipping and payment steps are also Plus only. On other plans, the same logic has to come from a public app or stay in the theme. Our Scripts to Functions guide shows how this mapping works for discounts and shipping.
Option 4: Ongoing upkeep by the month
Best when: you already have a custom app or integration and nobody owns it day to day.
Besides fixed projects, we take on monthly work for an app you run: fixes, new features, Shopify API version upgrades and monitoring. For a store worried about its checkout, that includes testing the purchase path after each app or theme change, reviewing new scripts before they go live, and checking who still has access. Our guide on maintaining a custom Shopify app lists what this upkeep covers.
How to choose
| Your situation | Where to start |
|---|---|
| You don’t know which of your apps load code on the storefront | Option 1 |
| One app with a custom JS field runs an important part of your store | Option 1, then option 2 |
| Scripts change prices, discounts or shipping | Option 3 |
| You have a custom app nobody maintains | Option 1, then option 4 |
Talk to us
The team behind StoreFleet, Shopify app developers since 2021, runs Shopify apps of its own with theme app extensions, admin extensions and Shopify Functions, and supports their merchants directly. Tell us which apps you run and what worries you, and we reply with the route we would take. Our page on hiring Shopify app developers explains what we take on, and you can send a short brief from there.