Shopify app source code scan
Shopify App Source Code Scan
$150Pay after deliveryOne repository
A low-cost first look at how your app is built: leaked secrets anywhere in git history, vulnerable dependencies and Shopify-specific mistakes in webhooks, OAuth and store isolation. We delete your code as soon as the report is delivered.
01Coverage
What we check
We scan the whole repository, including every commit in its history. A key deleted from the code years ago is still in every clone, so the history matters as much as the current branch.
The automated sweep uses Gitleaks across all commits, Trivy and OSV-Scanner for dependencies, secrets and misconfiguration, and Semgrep with standard security rule sets plus our own rules for Shopify app patterns: store scoping, webhook verification, constant-time signature checks, the shop parameter, OAuth state, mass assignment and postMessage origins.
Then we check by hand what scanners cannot see: every webhook endpoint, the OAuth callback, how store scoping is enforced, whether compliance webhooks actually delete data, and whether tools such as Laravel Telescope or Horizon are reachable in production.
For the detail behind each step, read what a source code security review finds in a Shopify app. For a real result, see our case study of a live Shopify app.
02Deliverables
What you receive
One written report that reads as a list of things to fix, not as raw scanner output. Results from different tools are deduplicated and grouped by class of problem.
- Critical findings firstLive credentials in the repository or its history, webhooks without verification and missing store isolation, each with the file, line and what to do.
- High and medium findingsGrouped by area: authentication, authorization, integrations, dependencies and configuration.
- Dropped false positivesWhat we checked and ruled out, and why, so your team does not have to investigate it again.
- Versions and support statusFramework and runtime versions compared with their end-of-life dates.
- Follow-upOne round of questions about the report within 10 business days.
03Your code
How we handle your code
Your source code is your most sensitive asset. We need as little access as possible, for as short a time as possible.
- Read-only access: a deploy key, a temporary collaborator role or a git bundle that includes history. Remove the access when we are done.
- Scanned locally on our machine. Code is not uploaded to external scanning services.
- No external AI services see your code unless you agree to it in writing before we start.
- Our copy, including scanner output, is deleted as soon as the report is delivered, and we confirm the deletion by email.
- Secrets are recorded redacted. We never copy a live credential into the report.
- We never change your code, push commits or open pull requests. Your team makes the fixes.
We do not need production secrets. If .env files are tracked in the repository, that is a finding. Confidentiality obligations are set out in our Terms of Service.
04Fit
When to choose this service
- You want a first security check before App Store submission on a small budget.
- You inherited the codebase, or several developers have worked on it over the years.
- You want the obvious issues fixed before paying for a test of the running app.
If Shopify has already asked for an incident report or independent testing, a code scan is not enough on its own. See the Shopify App Incident VAPT instead.
05Limits
What this scan does not cover
This is a source code scan, not a penetration test. We do not test the running app, its infrastructure or your test stores, so a code-level finding is not proven exploitable, and issues that only appear at runtime can be missed. No scan can prove that an app has no vulnerabilities. Fixes and retesting are not included.
To test how the running app behaves across two stores, see the Shopify App Security Readiness review.
Want a quick look at your code?
Tell us about your app and repository. We confirm the stack and timing before you pay.