Shopify App Security Checklist: What to Test Before App Store Review

Most teams treat Shopify app review as a formality until it isn’t. In February 2026, Shopify’s developer team told the community that review times were longer than usual, and that resubmitting sends you to the back of the queue.

Moreover, it’s easy enough to catch a failed install on your own. What’s easier to miss is what happens once a second store is using your app. Most Shopify apps serve many stores; as Shopify’s own security policy notes, bugs that matter include cases where one store can reach another store’s data. 

This checklist covers what to test before you submit, one check at a time, each with a pass/fail test. Every section ends with a Second Store Test, run from a second dev store. It’s independent, built from Shopify’s public documentation, and not an official Shopify list. Short on time? Jump to review timelines.

Why Do Shopify Apps Get Rejected on Security?

Most security-related rejections show up as functional failures: broken install, OAuth, embedding or webhook handling. Shopify’s common review problems include:

• No redirect to the OAuth grant screen after install
• A fatal error after install, or an app that won’t reinstall
• Switching between embedded and non-embedded versions
• Broken UI, or 404, 500 and 300-series errors
• Missing testing instructions or credentials
• Missing compliance webhooks and insecure webhook URLs

Separately, Shopify’s security checks flag missing mandatory GDPR compliance webhooks (MISSING_COMPLIANCE_WEBHOOKS) and non-HTTPS webhook URLs (INSECURE_WEBHOOK_URL). Security flaws such as missing authorisation or committed secrets are separate checks in Shopify’s app security checks. The sections below cover both kinds.

How Do You Secure OAuth and Session Authentication in a Shopify App?

Start OAuth right after install, validate every session token, and derive the shop from the authenticated session, never from request input. Some key checks include:

Second Store Test: Authenticate as Store A, then change shop, host and resource IDs to Store B’s on every route. Every request should be denied. Shopify’s documentation says authorization and tenant-isolation issues often can’t be found by a code scan alone, so ensure you test them manually.

How Do You Set Frame-ancestors CSP for an Embedded Shopify App?

Return a Content-Security-Policy: frame-ancestors header that is generated per shop and includes the shop domain and https://admin.shopify.com. A static wildcard usually fails. 

Content-Security-Policy: frame-ancestors https://{shop-domain}.myshopify.com https://admin.shopify.com;

Second Store Test: Load the app from two stores and compare headers. The shop domain should change with the store.

How Should You Handle Shopify & Compliance Webhooks?

Subscribe to the three mandatory compliance webhooks (customers/data_request, customers/redact and shop/redact), verify the HMAC on every request, and return 401 when it’s invalid.

Second store test: trigger customers/redact for Store A and confirm Store B’s data is untouched.

What Data Protections will Shopify Expect from Your App?

Least-privilege scopes, a protected customer data request if you use customer data, and personal data that is minimized, encrypted and deleted on schedule. For the level rules, see our Shopify App Store requirements guide.

Second Store Test: Use Store A’s access token against Store B’s resources. It should fail, and your scope list should show what a stolen token could do.

How Does the OWASP Top 10 Apply to Shopify App Security?

Each OWASP risk has a Shopify form, and most of them end up as cross-store problems. Shopify’s check IDs are in the third column.

3 Shopify-specific scenarios require their own tests specifically:

• Cross-shop IDOR: A query takes shop from request input instead of the session. Change it and see whose data comes back.
• App-proxy SSRF: An endpoint fetches an attacker-supplied URL. Point it at an internal address.
• XSS in theme app extensions: User-controlled text or metafield output renders as unsafe HTML on the storefront (THEME_EXTENSION_XSS). Store a script payload in a setting and load the storefront.

Second Store Test: Take a resource ID from Store B and request it as Store A through every surface: REST, GraphQL, app proxy and exports.

What Operational Security Should Be in Place Before You Submit?

Keep secrets out of code, keep environments separate, and have a plan for the day a token leaks. Shopify scans your app for open ports with Nmap during review, so unnecessary public services are a review issue as well as a security one.

Shopify’s CTP program requires many of these for Plus apps. See how the tiers compare.

Second Store Test: In your leaked-token tabletop, count how many stores one token exposes and how long revocation takes.

What Does Shopify’s AI Self-Review Catch, and What Can’t It?

Simply put, it’s a good first filter and a bad finish line. The self-review reads your local code, so it can judge what’s visible there and nothing else. Shopify’s pre-review tooling excludes anything that depends on listing content, live app behaviour, or merchant-facing UX, much of what makes an app work. 

Shopify’s developer team also recommends its Dev MCP for catching common issues before the review team flags them, and it’s worth using. 

Shopify’s ‘shopify app security check’ combines two things:

• Deterministic scans: fixed checks with exact answers, like whether an API version is end-of-life. 
• Agent review: deeper checks, such as whether a database query is scoped to one shop.

What neither can do, in our view, is attack your running app. They won’t run multi-store authorization attacks, abuse your business logic, test SSRF against live infrastructure, or confirm that deletion actually happened in every system holding the data. 

Here’s how we’d layer it:

1. Automated checks: Shopify’s tooling, dependency scanning, secret scanning and CI security tests.
2. AI self-review: a fast gate for requirements judged from code.
3. Manual pentest: a human attacking tenant isolation, OAuth edge cases, business logic, SSRF and webhooks.

A pentest isn’t a necessity for most apps per guidelines, with CTP as the only primary exception, but no tool reading your code can play Store B against your running app, as a human tester can.

Second Store Test: Run the first two layers, then pick the three highest-risk cross-store checks above and test them against the live app. If one store can reach another, you’ve found your first fix. If none can, you have evidence worth keeping. 

How Long Does Shopify App Review Take, and How Do You Avoid Resubmission Loops?

Shopify’s documentation doesn’t give a fixed review time & in our opinion, be wary of any advisory or article that does. In February 2026, its developer team reported reviews were taking longer than usual, with waits extending up to a month or more (even when submission emails continued to religiously promise up to 14 business days). 

Check Shopify’s current announcements before planning a launch (as of October 2026).

Your app moves through Draft, Submitted, Reviewed and Published, and Shopify assigns a reviewer once core requirements are met. You can withdraw at any point, but most of the control you have actually exists before you press submit.

Three rules which help you avoid resubmission loops:

• Don’t resubmit while you wait. It is very tempting, but per Shopify experts, doing so moves you to the back of the queue. 
• Don’t fail repeatedly. Apps that repeatedly fail review may face a temporary suspension, so a rushed second attempt often costs more delay than it was meant to save.
• Fix the avoidable failures first. As dull as they may be, per Shopify’s common-problems list, these are the highest risk:
  • No OAuth redirect after install, or a fatal error after install
  • An app that doesn’t reinstall
  • Embedded and non-embedded switching
  • Broken UI, or 404, 500 and 300-series errors
  • Missing testing instructions or credentials
  • Billing that doesn’t use Shopify’s required system

Therefore, run this gate before every submission:

1. Run Shopify’s automated checks and AI self-review.
2. Run Shopify app security check.
3. Test install, OAuth, reinstall, billing, UI, webhooks and uninstall on a development store.
4. Prepare a reviewer pack: test credentials, a demo store, a short screencast, a feature walkthrough and scope justifications.
5. Fix every requirement-level failure before resubmitting.

Second Store Test: Run the full gate on two development stores before you submit.

How can Astra help with Shopify App Security? 

You can run most of this checklist yourself; the part that’s hard to do alone is having someone else attack your app. 

That’s where Astra comes in. Think of it as an independent security test before submission: 

• Share your testing scope, including OAuth flows, webhooks, app proxies, and REST and GraphQL APIs. 
• Make sure cross-store access is explicitly included in the testing requirements.

Astra’s certified penetration testers assess your live app for security vulnerabilities, including business logic flaws that automated scans may miss.

You receive a detailed report with identified vulnerabilities and remediation guidance. Once you’ve addressed the findings, free rescans help verify the fixes alongside a publicly verifiable security certificate on our proprietary Trust Center.

Want an independent test before Shopify’s review team does it? Talk to a Security Expert → 

Final Thoughts

Good Shopify app security means you can say two things before you submit: one store can’t reach another’s data, and you have the evidence. Run each check from a second development store, keep what you find, and submit once.

FAQs