Insights
Shopify app security insights
Practical notes from testing Shopify apps: where tenant isolation, authentication and integrations tend to break, and how to check your own app.
Articles
-
· 11 min read
Cross-store IDOR in Shopify apps: how it happens and how to test for it
Most serious Shopify app findings are not exotic. They are one store reading or changing another store’s data because an endpoint trusted the wrong identifier. Here is where that happens and how to test for it with two development stores.
Read the article