AppPerimeter Insights Practical articles on Shopify app security: tenant isolation, authentication, webhooks and preparing evidence for review and retesting. https://appperimeter.com/insights/ 2026-10-29T00:00:00Z Aliaksandr Tarantsei Cross-store IDOR in Shopify apps: how it happens and how to test for it https://appperimeter.com/insights/cross-store-idor-shopify-apps/ 2026-10-29T00:00:00Z 2026-10-29T00:00:00Z Most serious Shopify app findings are not exotic. They are one store reading or changing another store’s data because an endpoint trusted the wrong identifier. Here is where that happens and how to test for it with two development stores. PHP2Shell: how we patched Shopify app servers, including Ubuntu 20.04 https://appperimeter.com/insights/php2shell-patching-shopify-app-servers/ 2026-10-29T00:00:00Z 2026-10-29T00:00:00Z On 21 October 2026 PHP fixed two critical, remotely exploitable flaws that affect every PHP installation serving web requests. Here is what we did on Shopify app backends, why some servers needed an Ubuntu upgrade first, and how to confirm that the fix is actually running. What a source code security review finds in a Shopify app https://appperimeter.com/insights/shopify-app-source-code-security-review/ 2026-10-28T00:00:00Z 2026-10-28T00:00:00Z Black-box testing shows what an attacker can reach from outside. With read access to the repository, we can also check how the app is built: leaked credentials in git history, vulnerable dependencies, and Shopify-specific mistakes such as unscoped queries or webhooks verified against the wrong body.