Shopify App Security Review: Pre-Launch Checklist

A Shopify app security review before launch is the process of checking how your app handles access tokens, webhooks, customer data, and dependencies before it goes live. It matters because a single missed check can expose store data, break trust, and force an emergency rollback. Whether you are a merchant installing a new app or a developer shipping one, this guide gives you a concrete pre-launch review you can run in a few hours.

Shopify's "Securing your app, together" initiative has made security a shared responsibility. Merchants are asking harder questions, and app owners are expected to prove their app is safe. The good news: most risks are known and preventable. Below is a step-by-step checklist that covers the core risks, what to ask your development partner, and how to keep the app secure after launch.

Why Shopify app security matters for merchants and app owners

For merchants, an insecure app is a direct threat to revenue and reputation. A leaked access token can let an attacker read orders, modify products, or export customer data. A missing webhook verification can let anyone send fake order events into your system. And a dependency with a known vulnerability can be exploited without anyone touching your code.

For app owners, the stakes are just as high. Shopify's app review process checks for security basics, but it is not a full penetration test. A breach after launch can lead to removal from the App Store, legal exposure, and lost customers. A pre-launch security review is cheaper than an incident response.

The core risks: OAuth tokens, webhook verification, data storage

Most Shopify app security incidents trace back to three areas. Understand these before you start the checklist.

OAuth tokens and session management

OAuth tokens are the keys to a store. If they are stored in plain text, logged in error messages, or exposed in client-side code, an attacker can use them. Tokens should be encrypted at rest, scoped to the minimum permissions needed, and rotated when possible. Session management must prevent fixation and ensure tokens are not leaked in URLs.

Webhook verification and request authenticity

Shopify sends webhooks for events like orders/create or products/update. Without verification, anyone can POST fake data to your endpoint. Every webhook must be verified using the HMAC signature Shopify provides. Also check that your endpoint is idempotent and handles replay attacks.

Data storage and third-party dependencies

Where does your app store customer data? If it is in a database, is it encrypted? Are backups secured? And what about third-party libraries? A single outdated package with a known CVE can undo all your other efforts. Use dependency scanning and keep packages up to date.

A step-by-step pre-launch security review checklist

Use this checklist as a gate before you publish. Each item is a concrete action, not a vague goal.

1. Map your data flows

List every place data enters, moves, and rests. Include Shopify APIs, your backend, databases, third-party services, and logs. Identify which data is sensitive (customer PII, order details, tokens). This map guides the rest of the review.

2. Review OAuth and token handling

• Confirm tokens are encrypted at rest (e.g., using KMS or a secrets manager).
• Ensure tokens are never logged or exposed in error messages.
• Use the minimum scopes required; avoid requesting unnecessary permissions.
• Implement token rotation and revocation flows.
• Check that session IDs are not passed in URLs.

3. Verify webhook security

• Validate the HMAC signature on every webhook request.
• Use a constant-time comparison to prevent timing attacks.
• Reject requests with missing or invalid signatures.
• Implement idempotency to handle duplicate deliveries.
• Log webhook failures for monitoring.

4. Audit data storage and encryption

• Encrypt sensitive data at rest (database-level or application-level).
• Use TLS for all data in transit.
• Restrict database access to the app's backend only.
• Ensure backups are encrypted and access-controlled.
• Define a data retention policy and implement deletion on uninstall.

5. Scan dependencies and infrastructure

• Run a dependency scanner (e.g., npm audit, OWASP Dependency-Check) and fix critical issues.
• Keep your runtime and libraries patched.
• Use infrastructure-as-code with security groups and least-privilege IAM roles.
• Enable logging and monitoring for suspicious activity.

6. Test authentication and authorization

• Verify that users can only access their own store's data.
• Test for broken object-level authorization (BOLA) by manipulating IDs.
• Ensure admin endpoints require proper roles.
• Check that API rate limits are enforced.

7. Prepare an incident response plan

• Document who to contact and how to revoke tokens if a breach occurs.
• Set up alerts for unusual API usage or failed webhook verifications.
• Have a rollback plan for app updates.

What to ask your Shopify app development partner

If you are hiring a team to build or review your app, ask these questions. The answers will tell you whether security is baked in or bolted on.

• How do you store and encrypt OAuth tokens?
• How do you verify webhooks, and can you show me the code?
• What dependency scanning and penetration testing do you perform before launch?
• How do you handle data deletion when a merchant uninstalls?
• Can you provide a security review report as part of the deliverable?

A partner who cannot answer these clearly is a risk. At Digital Executive Partner, we build custom Shopify apps with security reviews built into the process. You can see our approach on our Shopify app development page. We also offer a pre-launch security review as a standalone service for apps built elsewhere.

Ongoing monitoring and maintenance after launch

Security is not a one-time event. After launch, schedule regular reviews: monthly dependency scans, quarterly access reviews, and annual penetration tests. Monitor for unusual token usage, failed webhook verifications, and error rates. Keep an incident response plan updated with current contacts.

For merchants, ask your app providers for their security posture and incident history. For app owners, treat security as a feature: document it, test it, and communicate it. A public security page with your practices builds trust and differentiates you in the App Store.

Quick reference: pre-launch security review checklist

Area	Check	Done
OAuth	Tokens encrypted at rest	☐
OAuth	Minimum scopes only	☐
Webhooks	HMAC signature verified	☐
Webhooks	Idempotency implemented	☐
Data	Encryption at rest and in transit	☐
Data	Deletion on uninstall	☐
Dependencies	No critical vulnerabilities	☐
Auth	Object-level authorization tested	☐
Incident	Response plan documented	☐

Use this table as a gate. If any box is unchecked, fix it before launch. For a deeper dive into building secure Shopify apps, see our products page for tools that help with compliance and automation.

A security review does not have to be complex. Start with the three core risks, run the checklist, and ask your partner the hard questions. That is how you protect your store, your customers, and your reputation.

Related reading

• Shopify App Security Checklist: Verify Before Launch
• Custom Shopify App Development Services: What You Get