Shopify App Security Readiness
$900
USD. Taxes, if applicable, are additional.
Identify common security gaps before your next review.
- One app
- Up to 20 agreed endpoints
- Incident report assistance: Not included
- Retest: Not included
Pricing
Shopify app security services and pricing
Choose a starting point for your app. We confirm scope, availability and any additional work before you commit.
Packages
Includes one retest
Shopify App Incident VAPT
$3,500
USD. Taxes, if applicable, are additional.
Test the app, organize incident evidence and document the next steps.
- One app
- Up to 30 agreed endpoints
- Incident report assistance: Incident report draft from your records
- Retest: One retest of confirmed findings within 30 days, with addendum
Shopify Security Retest & Evidence Pack
$800
USD. Taxes, if applicable, are additional.
Verify agreed fixes and prepare a clear evidence summary.
- One app
- Up to 10 previously reported findings
- Incident report assistance: Not included
- Retest: This is the retest
Compare packages
| Feature | Security Readiness$900 | Incident VAPT$3,500 | Retest & Evidence$800 |
|---|---|---|---|
| Type of work | Bounded readiness assessment | Manual and automated VAPT | Single retest round of existing findings |
| Applications | One app | One app | One app |
| Environments | One environment, one backend/API | One backend/API; staging or agreed safe production checks | As agreed for the retest |
| Endpoints / findings | Up to 20 agreed endpoints | Up to 30 agreed endpoints | Up to 10 previously reported findings |
| Test stores | Two test stores | Two test stores | As agreed |
| Roles | — | Up to three roles | — |
| Incident report assistance | Not included | Incident report draft from your records | Not included |
| Report | PDF report with methodology, scope, limitations, findings and fix priorities; 30-minute walkthrough | Signed technical VAPT report, executive summary, plan for materials to Shopify | Signed PDF addendum (resolved / unresolved / inconclusive) plus evidence summary for Shopify correspondence |
| Retest | Not included | One retest of confirmed findings within 30 days, with addendum | This is the retest |
Prices are fixed for the standard scope shown, in USD. Taxes, if applicable, are additional. We confirm the package fits your app after scoping and before any payment. Additional scope is quoted separately in writing.
?Questions
Frequently asked questions
Are these fixed prices?
Yes, for the standard scope shown. We confirm fit before you commit; additional scope is quoted separately.
Does the VAPT include fixing the code?
No. Your development team implements changes; the included retest verifies agreed findings after remediation.
Is a retest included in Incident VAPT?
Yes, one retest of confirmed findings within the agreed scope and window is included.
Will Shopify accept the report?
Shopify decides whether a submission meets its requirements. We recommend confirming any provider, scope or format requirements with Shopify before commissioning work.
Can you guarantee the app has no vulnerabilities?
No. Every assessment has a defined scope and reflects the application and information available at the time of testing.
Can you test production?
Potentially, with explicit authorization and agreed safety boundaries. We prefer test stores and production-like staging where suitable.
Do you use AI in testing?
Yes, as support. Alongside established tools we use our own AI-assisted analysis tooling to spot Shopify-specific patterns. Every finding in a report is reproduced and verified manually by a tester.
Not sure which package fits?
Tell us what you need to assess and any deadline. We’ll recommend a starting point.