man ./field-guide
The reference shelf. Best-practice how-tos for building a Shopify app that stays locked down.
- Authorization: who's allowed to touch what #authorization#authentication#access-control
Authentication proves who you are. Authorization decides what you can see and change — and getting it wrong is how one merchant reads another's orders. How to define it, enforce it server-side, and lock it down with deterministic tests.
- Security reviews in CI: an AI pentester on every PR #ci-cd#github-actions#ai
How to wire Strix (or any AI harness) into GitHub Actions without letting it own your repo. Run it before merging, and on a regular interval.