Secure your Shopify app
before the raccoons get in.
A terminal field guide for Shopify developers. Bandit — a masked trash panda — shows you exactly how he'd rummage through your app, then how to lock the can.
ls ./sections
Dumpster Dives
Deep teardowns of a single vuln class, start to exploit.
The Field Guide
OAuth, HMAC, webhooks, scopes, CSP, secret storage.
Incidents
Running timelines of real Shopify-ecosystem security incidents.
Trap Cards
Quick gotcha tips you can act on in five minutes.
Trash Talk
Short posts, hot takes, and release notes.
Loot
Checklists, snippets, and copy-paste hardening.
tail -n 3 ./dumpster-dives
cat ./severity-examples
CRITICAL Access token in localStorage
🦝 Bandit opened DevTools and walked off with your Admin API token.
It's now a permanent credential sitting in browser storage.
→ fix: keep tokens server-side; use session tokens + App Bridge for the frontend.
WARN Webhook has no HMAC verification
🦝 He POSTed a fake
orders/create to your endpoint. You trusted it.
→ fix: verify the
X-Shopify-Hmac-Sha256 header against your app secret before processing.INFO Requesting write_orders you never use
Over-scoped OAuth. Every extra scope is extra loot if you're breached.
→ fix: request the minimum scopes; audit on each release.