Shopify's new app security update: the right fixes, too late for Black Friday

Shopify has published a fresh round of security updates for app developers, with a new app security hub to go with them. Most of it is sound work. Almost none of it lands before Black Friday, and nothing in it touches the app code already running on your store.

Image: Shopify

What Shopify announced on 27 October

"App devs 📢 We've got a fresh round of security updates. And a new security hub to go with them," Shopify Devs posted. The official post follows its 20 October call to developers, Securing your app, together. Here is what's in it.

• One requirement. "All public apps that call the Admin API must migrate to expiring offline access tokens by January 1, 2027." That date isn't new. What's new is the enforcement ladder: on 1 January apps that haven't moved are delisted and blocked from new installs, though "existing installs keep working"; on 15 January merchants using them see a warning in Shopify admin; on 1 April, Admin API requests with non-expiring tokens return HTTP 403.
• An IP allowlist for the Admin API, which Shopify "strongly recommends". Requests from any other address "fail with a 403".
• Network access hosts. Apps can declare up to 20 web addresses their code loads from or sends data to. Shopify says: "We use the list to protect your app and monitor storefronts for malicious requests." Optional, no date.
• Client credentials, so an app's server can get a fresh token signed with its private key, and developer identity checks before apps install on development and client-transfer stores.
• A security hub ranking the eight things attackers target most, with a new shopify app security check command to run before every release.

What's genuinely good

Credit where it's due. Expiring tokens and an IP allowlist mean a stolen key is worth far less, for far less time. The security hub is unusually candid: two of its eight targets are "Unescaped or shared values in theme app extensions" and "Runtime configuration and internal tools reaching storefronts". That second one describes the checkout hijack closely. In the case traced publicly, the bad code arrived in settings the app fetched from its vendor's own servers.

Network access hosts matter most to merchants. For the first time, Shopify is asking apps to say where their storefront code talks to, and saying it will watch for anything else. That goes at the right problem.

Why it still feels too late

This is my opinion, and it rests on the calendar. Black Friday is 27 November and Cyber Monday is 30 November. The only mandatory change is due on 1 January, and its old tokens keep working until April. Network access hosts are optional, with no date. On 20 October Shopify promised to tighten "the boundaries for storefront app code" and raise App Store security requirements, sharing details and timelines first. A week on, neither has a date.

Nor is anything here aimed at what's already installed. 563 apps have now left the App Store since 14 October. Delisting stops new installs, but an app's code keeps loading on every store that has it until the merchant removes it. The new ladder works the same way: delisted on 1 January, existing installs keep working. And neither post mentions the October hijacks or the removals.

To be fair, Shopify can't rewrite thousands of apps in a month. Its 20 October post said attacks are increasing "as AI gets better at finding vulnerabilities", and it shipped the leave store warning the same day. But these updates protect future installs and the 2027 platform. Your busiest weekend of the year runs on the apps installed today.

What to do before Black Friday

1. Run the free scan. It lists every app loading code on your store and flags any Shopify has removed. Results in about two minutes, nothing to install.
2. Search your apps in the delisted apps tracker. If one is there, look for the vendor's explanation before you act.
3. Uninstall apps you don't use, then switch off leftover app embeds in Online Store > Themes > Customize > App embeds.
4. Check custom JavaScript fields in app settings for code your team didn't add.
5. Ask each storefront app vendor two questions: have you moved to expiring tokens, and have you declared your network access hosts? A vendor taking security seriously can answer both now.
6. Set a date to freeze new app installs and theme changes before the peak.
7. In a private window, on desktop and mobile, go product, cart, then your real checkout button. The address should be your domain or Shopify's checkout. Then keep checking through the weekend, not once.

Watch it through BFCM

Revenue Shield does that last step for you. It runs real purchase journeys on desktop and mobile, on a schedule, in a fresh browser every time, and never places an order. Every run records where checkout actually landed, so a hijacked button fails the check and your team gets an alert with a video. The app scan lists every app and script on your storefront, flags delisted ones, and tells you when one appears or changes.

It's monitoring, not protection. It won't block an attack. It shortens the time between something going wrong and you knowing, which on Black Friday is measured in orders.

Agencies: cover your clients before the peak with a 14-day free trial on up to 10 stores, then £7 per store per month. It works from Claude and ChatGPT too.

Sources: Shopify: Security update (27 Oct), Shopify: Securing your app, together (20 Oct), Shopify app security hub, script tags deprecation (they stop running on storefronts on 1 March 2027). Background: the checkout hijack explained, why delisted doesn't mean gone.