Shopify app security check: what the new scanner covers

Shopify has added a local app security checker to its AI Toolkit and CLI. Announced on 15 October 2026, it examines app code, extension configuration and dependencies for common vulnerability patterns, then helps developers investigate and fix findings before release.

The useful distinction is between what the command can determine automatically and what needs judgement. Running the CLI alone does not complete the agent-led review.

Two parts to the check

The security-check guide separates deterministic inspections from agent review. An expired API version can be identified by a fixed check; deciding whether database access is restricted to the correct shop can require investigation of the application.

Shopify lists checks for committed secrets, missing authorisation, unverified app-proxy signatures and missing tenant isolation, among others. Findings use stable identifiers such as COMMITTED_SECRET and MISSING_TENANT_ISOLATION, which link developers to the relevant remediation guidance.

The workflow supports different frameworks, but that does not mean every automatic check works identically across them. Some deterministic checks support only the React Router app template; other frameworks leave those checks to agent review.

How developers can run it

With Shopify AI Toolkit installed, open the app directory and ask the coding agent:

/shopify Check my app for security vulnerabilities

The agent runs the scan, investigates the remaining checks and presents the combined results. Alternatively, start with shopify app security check and pass its review instructions to your agent. The agent records findings with shopify app security record and presents them with shopify app security review. Without an agent, only the deterministic scan is performed.

Pay attention to scan scope. Git-ignored files are skipped by default, while tracked files are scanned. The documentation describes --no-git-ignore and exclusion options for adjusting coverage; review those settings before treating a report as representative of the whole app.

Read Shopify’s original launch post on X.

What merchants should ask their app builders

Our recommendation for a custom app handover is to ask which version was checked, whether both stages were completed, and which serious findings remain unresolved. A report is more useful when it includes the fixes and a repeat check, rather than just the command’s exit status.

Developers should review proposed fixes before deploying them and repeat the check on subsequent releases. Shopify recommends starting with critical and high-severity findings. The checker adds evidence to that release decision; it does not replace responsibility for the app’s behaviour or its access to merchant data.