{"id":49847,"date":"2026-10-28T14:06:14","date_gmt":"2026-10-28T08:36:14","guid":{"rendered":"https:\/\/www.getastra.com\/blog\/?p=49847"},"modified":"2026-10-28T14:06:17","modified_gmt":"2026-10-28T08:36:17","slug":"shopify-app-store-requirements","status":"publish","type":"post","link":"https:\/\/www.getastra.com\/blog\/penetration-testing\/shopify-app-store-requirements\/","title":{"rendered":"Shopify App Store Requirements: Do You Need a Pentest?\u00a0"},"content":{"rendered":"<div class=\"gb-container gb-container-e43a8917\">\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Key_Takeaways\"><\/span>Key Takeaways<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<ul class=\"wp-block-list\">\n<li>If your app is on the public App Store, Shopify reviews it for web vulnerabilities, TLS, open ports and token security, and rejects it until the findings are fixed.<\/li>\n\n\n\n<li>If your app reads customer names, addresses, phone numbers or emails, you fall under Level 2 and need to be ready for a data protection review.<\/li>\n\n\n\n<li>If your app serves Shopify Plus merchants and you\u2019re in CTP, you need an annual independent pentest plus 17 other security controls.<\/li>\n\n\n\n<li>Shopify\u2019s bug bounty won\u2019t pay for bugs in your app, so the only independent testing you get is the testing you commission.<\/li>\n\n\n\n<li>Whichever program applies, one retestable report covering your APIs, OAuth flows, webhooks and token handling can serve as proof across reviews.<\/li>\n<\/ul>\n\n<\/div>\n\n\n<p class=\"wp-block-paragraph\">Shopify App Store requirements have a lot to say about app security, and almost none of it says \u201cget a pentest.\u201d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Dig through the App Store review rules, the protected customer data requirements, the Built for Shopify criteria, and the Certified Technology Partner list, and you\u2019ll find only one program that mentions penetration testing.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Others are just expected to be secure, which is fair, except there is no clear definition of the word or process for proving the same. Seems harmless, right? It usually is until:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A certification deadline gets close\u00a0<\/li>\n\n\n\n<li>A data protection review ends up in your inbox\u00a0<\/li>\n\n\n\n<li>Or Shopify emails to say your app has been removed from the App Store after leaked keys or exposed access tokens, and you need independent proof of security fast.\u00a0<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">App teams in that spot tell us the same thing: they\u2019ve read the docs and still can\u2019t say whether they need a pentest, which program\u2019s rules apply, or what to hand over.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">This guide maps every Shopify program side by side, links to the Shopify page behind each requirement, and quotes Shopify where the wording matters. One idea runs through all of it: being secure and being able to prove it are different things.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Who_must_pentest_and_who_is_only_expected_to_be_secure\"><\/span>Who must pentest, and who is only expected to be secure<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Shopify\u2019s<\/strong> <a href=\"https:\/\/help.shopify.com\/en\/partners\/partner-program\/how-to-qualify\" target=\"_blank\" rel=\"noopener\"><strong><\/strong><strong>CTP requirements<\/strong><\/a> <strong><\/strong>call for an <strong>\u201cannual independent third-party security penetration test\u201d<\/strong> of your application, following OWASP and NIST methodologies. It is the only program in this guide that names a pentest.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Expected to be secure, no pentest named:<\/strong><\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Every public App Store app:<\/strong> Shopify reviews security before publishing and rejects apps where it finds vulnerabilities.<\/li>\n\n\n\n<li><strong>Apps using protected customer data:<\/strong> You must meet Level 1 or Level 2 requirements, and Shopify may select you for a data protection review.<\/li>\n\n\n\n<li><strong>Built for Shopify apps:<\/strong> You must keep meeting App Store requirements, and Shopify re-reviews them every year.<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">But why should \u201conly expected to be secure\u201d still matter?&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Shopify\u2019s <a href=\"https:\/\/help.shopify.com\/en\/partners\/help-support\/faq\/removal\" target=\"_blank\" rel=\"noopener\">enforcement policy<\/a> treats missing its requirements as a Partner Program violation, whereby actions range from pulling your app from promotional surfaces to delisting it, which Shopify describes as \u201ctemporarily or permanently removing it from the Shopify App Store.\u201d&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If that happens, you\u2019ll likely need independent evidence of your security, and quickly.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pro Tip:<\/strong> Even if you\u2019re not in CTP, its 18 security controls are a useful benchmark: the most detailed written security bar Shopify publishes for apps alongside App Store baseline checks. Meeting them puts you in good shape for every other tier.&nbsp;<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_are_the_Shopify_App_Store_security_requirements_at_each_tier\"><\/span>What are the Shopify App Store security requirements at each tier?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Shopify\u2019s security expectations come in four layers: the App Store baseline, protected customer data, Built for Shopify, and Certified Technology Partner.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">While they do stack up, unlike a strict ladder, the CTP page states that Partners are not required to meet all Built for Shopify requirements, and that the two are separate designations. What applies to you depends on what your app does and which programs you join.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">1. Shopify App Store Requirements&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Shopify reviews every app\u2019s security before publishing it. Its <a href=\"https:\/\/shopify.dev\/docs\/apps\/build\/security\" target=\"_blank\" rel=\"noopener\">app security guide<\/a> lists five checks: protection against common web vulnerabilities, including the OWASP Top 10, encryption in transit, closed network service ports, secure token generation, and careful handling of shortened URLs.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Shopify scans for open ports with Nmap and asks you to justify or close anything unexpected. Separately, if the review finds vulnerabilities, \u201cyour app will be rejected\u201d until you fix them.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/shopify.dev\/docs\/apps\/launch\/shopify-app-store\/app-store-requirements\" target=\"_blank\" rel=\"noopener\">App Store requirements<\/a> add a valid TLS certificate, only the access scopes your app needs, and OAuth immediately after install.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">2. Protected Customer Data (Level 1 and Level 2)&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">If a public app uses customer data through the Admin API or Customer Account API, it must request access and meet the <a href=\"https:\/\/shopify.dev\/docs\/apps\/launch\/protected-customer-data\" target=\"_blank\" rel=\"noopener\">protected customer data requirements<\/a>, whereby Level 1 covers data excluding name, address, phone, and email &amp; Level 2 applies when you use any of those fields.&nbsp;<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">3. Built for Shopify Requirements<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Built for Shopify (BFS) is a quality badge, under which you must keep meeting App Store requirements and stay in good Partner standing, and the rest of the Built for Shopify requirements cover performance, design, and integration.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Shopify reviews BFS apps annually and gives 60 days to fix failures.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">4. Certified Technology Partner (CTP)<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">CTP is Shopify\u2019s program for apps serving Shopify Plus merchants. Its <a href=\"https:\/\/help.shopify.com\/en\/partners\/partner-program\/how-to-qualify\" target=\"_blank\" rel=\"noopener\">qualification requirements<\/a> include 18 security controls, starting with the annual pentest.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">If you have been searching for the \u201cShopify Plus certified app\u201d program, this is it. Shopify retired the Plus Certified App Program (PCAP) brand in December 2025 and replaced it with the Certified Technology Partner Program, per its <a href=\"https:\/\/help.shopify.com\/en\/partners\/about\/partner-program-tiers\" target=\"_blank\" rel=\"noopener\">Partner Program page<\/a>.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is how the four tiers compare, as of October 2026. A dash means the tier adds no specific requirement of its own.<\/p>\n\n\n\n<div id=\"tablepress-502-scroll-wrapper\" class=\"tablepress-scroll-wrapper\">\n<table id=\"tablepress-502\" class=\"tablepress tablepress-id-502 column1-color tablepress-responsive\">\n<thead>\n<tr class=\"row-1\">\n\t<th class=\"column-1\">Requirement<\/th><th class=\"column-2\">App Store baseline<\/th><th class=\"column-3\">Protected customer data<\/th><th class=\"column-4\">Built for Shopify<\/th><th class=\"column-5\">Certified Technology Partner<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"row-striping row-hover\">\n<tr class=\"row-2\">\n\t<td class=\"column-1\">Independent pentest<\/td><td class=\"column-2\">Not required<\/td><td class=\"column-3\">Not required<\/td><td class=\"column-4\">Not required<\/td><td class=\"column-5\">Required every year (OWASP and NIST)<\/td>\n<\/tr>\n<tr class=\"row-3\">\n\t<td class=\"column-1\">OWASP Top 10 protection<\/td><td class=\"column-2\">Checked in review; vulnerabilities mean rejection<\/td><td class=\"column-3\">-<\/td><td class=\"column-4\">Inherits App Store<\/td><td class=\"column-5\">Tested through the annual pentest<\/td>\n<\/tr>\n<tr class=\"row-4\">\n\t<td class=\"column-1\">Open ports and token strength<\/td><td class=\"column-2\">Checked in review<\/td><td class=\"column-3\">-<\/td><td class=\"column-4\">Inherits App Store<\/td><td class=\"column-5\">-<\/td>\n<\/tr>\n<tr class=\"row-5\">\n\t<td class=\"column-1\">Encryption in transit<\/td><td class=\"column-2\">Valid TLS certificate<\/td><td class=\"column-3\">Level 1<\/td><td class=\"column-4\">Inherits App Store<\/td><td class=\"column-5\">TLS 1.2 or higher<\/td>\n<\/tr>\n<tr class=\"row-6\">\n\t<td class=\"column-1\">Encryption at rest<\/td><td class=\"column-2\">-<\/td><td class=\"column-3\">Level 1<\/td><td class=\"column-4\">-<\/td><td class=\"column-5\">AES-128 minimum, managed keys<\/td>\n<\/tr>\n<tr class=\"row-7\">\n\t<td class=\"column-1\">Minimum API scopes<\/td><td class=\"column-2\">Required; you may need to justify them<\/td><td class=\"column-3\">-<\/td><td class=\"column-4\">Inherits App Store<\/td><td class=\"column-5\">Every scope justified, none unused<\/td>\n<\/tr>\n<tr class=\"row-8\">\n\t<td class=\"column-1\">Secrets and token storage<\/td><td class=\"column-2\">-<\/td><td class=\"column-3\">-<\/td><td class=\"column-4\">-<\/td><td class=\"column-5\">Secrets manager or encrypted storage, rotatable<\/td>\n<\/tr>\n<tr class=\"row-9\">\n\t<td class=\"column-1\">Architecture diagram<\/td><td class=\"column-2\">-<\/td><td class=\"column-3\">-<\/td><td class=\"column-4\">-<\/td><td class=\"column-5\">Required<\/td>\n<\/tr>\n<tr class=\"row-10\">\n\t<td class=\"column-1\">Retention periods<\/td><td class=\"column-2\">-<\/td><td class=\"column-3\">Level 1<\/td><td class=\"column-4\">-<\/td><td class=\"column-5\">Required<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<!-- #tablepress-502 from cache -->\n\n\n\n<p class=\"wp-block-paragraph\">Security is only part of the review. Shopify\u2019s <a href=\"https:\/\/shopify.dev\/docs\/apps\/launch\/shopify-app-store\/app-store-requirements\" target=\"_blank\" rel=\"noopener\">App Store requirements<\/a> also cover:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Billing:<\/strong> charges must go through Managed Pricing or the Shopify Billing API, and off-platform billing isn\u2019t allowed.<\/li>\n\n\n\n<li><strong>Interface:<\/strong> the app must be operable through a UI, and embedded admin experiences use tools like Shopify App Bridge.<\/li>\n\n\n\n<li><strong>Listing:<\/strong> the app must deliver the features its listing describes.<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_are_the_18_Certified_Technology_Partner_Security_Controls\"><\/span>What are the 18 Certified Technology Partner Security Controls?&nbsp;<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Shopify lists 18 security requirements, and Certified Technology Partners must meet all of them. Here they are in Shopify\u2019s order, translated into plain English, with the proof you would typically show for each.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Please note that the proofs are our suggestions; Shopify does not prescribe how you evidence each control.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Testing and secrets<\/strong><\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Annual independent pentest:<\/strong> An outside team attacks your app every year, following OWASP and NIST methodologies. <em>Proof: the pentest report.<\/em><\/li>\n\n\n\n<li><strong>Locked-down secrets:<\/strong> Store Shopify tokens and secrets in a secrets manager or encrypted storage, and rotate them without code changes. Encrypt access tokens at rest (AES-128 or higher) and never hardcode secrets. <em>Proof: configuration, plus a pentest that checks for exposure.<\/em><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Architecture and data&nbsp;<\/strong><\/p>\n\n\n\n<ol start=\"3\" class=\"wp-block-list\">\n<li><strong>Architecture diagrams:<\/strong> Show the components that handle Shopify data, the data flows, security controls, cloud providers, and regions. <em>Proof: the diagram.<\/em><\/li>\n\n\n\n<li><strong>Separate test and production:<\/strong> Test environments must be technically isolated from production. <em>Proof: infrastructure configuration.<\/em><\/li>\n\n\n\n<li><strong>Minimize data, with a data map:<\/strong> Process only the personal data you need, and document where each type is stored. <em>Proof: a data inventory.<\/em><\/li>\n\n\n\n<li><strong>Least-privilege API scopes:<\/strong> Request only the scopes you need, justify each, and remove unused or deprecated ones. <em>Proof: your scope list with a reason per scope.<\/em><\/li>\n\n\n\n<li><strong>Retention limits:<\/strong> Set retention periods for every store holding personal data, then delete or anonymize on expiry. <em>Proof: policy and deletion records.<\/em><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Encryption and resilience&nbsp;<\/strong><\/p>\n\n\n\n<ol start=\"8\" class=\"wp-block-list\">\n<li><strong>Encryption in transit:<\/strong> TLS 1.2 or higher, with no weak ciphers or outdated protocols. <em>Proof: TLS scan or pentest results.<\/em><\/li>\n\n\n\n<li><strong>Encryption at rest:<\/strong> Standard industry encryption (AES-128 minimum) with managed key services. <em>Proof: configuration.<\/em><\/li>\n\n\n\n<li><strong>Encrypted backups, tested restores:<\/strong> Encrypt backups and prove you can restore at least every 12 months. <em>Proof: a restore test record.<\/em><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Access and monitoring&nbsp;<\/strong><\/p>\n\n\n\n<ol start=\"11\" class=\"wp-block-list\">\n<li><strong>Access logs and anomaly detection:<\/strong> Log all access to personal data stores and detect unusual patterns. <em>Proof: logs and alert rules.<\/em><\/li>\n\n\n\n<li><strong>Role-based access and audit logging:<\/strong> Limit who can reach those stores by role, and keep audit records. <em>Proof: an access matrix.<\/em><\/li>\n\n\n\n<li><strong>Strong staff authentication:<\/strong> 12+ character passwords and multi-factor authentication for everyone who can reach production data. <em>Proof: identity provider settings.<\/em><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Process and incident response&nbsp;<\/strong><\/p>\n\n\n\n<ol start=\"14\" class=\"wp-block-list\">\n<li><strong>A vulnerability reporting program:<\/strong> A public security contact and remediation timelines by severity. <em>Proof: your published policy.<\/em><\/li>\n\n\n\n<li><strong>A patching process:<\/strong> A defined way to patch vulnerabilities and track fixes to closure. <em>Proof: ticket and SLA records.<\/em><\/li>\n\n\n\n<li><strong>Staff policies and training:<\/strong> Written rules for handling personal data, enforced and trained. <em>Proof: policy and training records.<\/em><\/li>\n\n\n\n<li><strong>An incident response plan:<\/strong> A documented plan with a named security contact. <em>Proof: the plan.<\/em><\/li>\n\n\n\n<li><strong>24-hour breach notification:<\/strong> Tell Shopify within 24 hours of a confirmed breach. <em>Proof: a step in your incident plan.<\/em><\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Notice the pattern? About half of these can only be proven with documents and configuration. The rest are claims a tester can check from the outside.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Paperwork and configuration cover the first group, but for the second you need someone to attack your secrets, tokens, TLS, and data stores and see what gives, which is what a pentest does.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"What_is_the_Difference_Between_Protected_Customer_Data_Level_1_and_Level_2\"><\/span>What is the Difference Between Protected Customer Data Level 1 and Level 2?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Short answer: Level 1 covers customer data without the identifying fields. Level 2 applies as soon as your app uses a name, address, phone number, or email.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Many teams do not know which level applies until Shopify asks, so map the fields you use first. Here is how the levels break down.<\/p>\n\n\n\n<div id=\"tablepress-503-scroll-wrapper\" class=\"tablepress-scroll-wrapper\">\n<table id=\"tablepress-503\" class=\"tablepress tablepress-id-503 column1-color tablepress-responsive\">\n<thead>\n<tr class=\"row-1\">\n\t<th class=\"column-1\">Level<\/th><th class=\"column-2\">Data your app uses<\/th><th class=\"column-3\">What you must do<\/th>\n<\/tr>\n<\/thead>\n<tbody class=\"row-striping row-hover\">\n<tr class=\"row-2\">\n\t<td class=\"column-1\">0<\/td><td class=\"column-2\">No customer data<\/td><td class=\"column-3\">Nothing extra<\/td>\n<\/tr>\n<tr class=\"row-3\">\n\t<td class=\"column-1\">1<\/td><td class=\"column-2\">Customer data excluding name, address, phone, and email<\/td><td class=\"column-3\">Request access, then meet the Level 1 requirements<\/td>\n<\/tr>\n<tr class=\"row-4\">\n\t<td class=\"column-1\">2<\/td><td class=\"column-2\">Customer data including any of those fields<\/td><td class=\"column-3\">Request access to the data and fields, meet Level 1 and Level 2 requirements, and take part in data protection reviews<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<!-- #tablepress-503 from cache -->\n\n\n\n<p class=\"wp-block-paragraph\">Shopify approves access only to the minimum data your app needs to deliver its functionality, so over-asking can get you declined.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Level 1<\/strong> has 9 requirements:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Process only the minimum personal data<\/li>\n\n\n\n<li>Tell merchants what you process and why<\/li>\n\n\n\n<li>Limit processing to those purposes<\/li>\n\n\n\n<li>Respect customer consent decisions<\/li>\n\n\n\n<li>Respect opt-outs from data sharing or sale<\/li>\n\n\n\n<li>Let customers opt out of automated decisions with legal or significant effects<\/li>\n\n\n\n<li>Have privacy or data protection agreements with merchants<\/li>\n\n\n\n<li>Apply retention periods<\/li>\n\n\n\n<li>Encrypt data at rest and in transit<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Level 2<\/strong> adds another 7:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Encrypt backups<\/li>\n\n\n\n<li>Keep test and production data separate<\/li>\n\n\n\n<li>Have a data loss prevention strategy<\/li>\n\n\n\n<li>Limit staff access<\/li>\n\n\n\n<li>Require strong staff passwords<\/li>\n\n\n\n<li>Keep an access log<\/li>\n\n\n\n<li>Implement a security incident response policy<\/li>\n<\/ul>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"How_do_Data_Protection_Reviews_Select_Apps\"><\/span>How do Data Protection Reviews Select Apps?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">Shopify says, \u201cwe might ask for a detailed review of your practices,\u201d and that you will need to show evidence your app meets the requirements. Any app might be selected, and a review can come after you have already implemented everything.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Thus, Shopify\u2019s reviews will presumably focus on apps with:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>A high number of merchant installs<\/li>\n\n\n\n<li>A high volume of customer records<\/li>\n\n\n\n<li>More protected customer fields approved<\/li>\n\n\n\n<li>Long retention of personal data<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>Pro Tip:<\/strong> 2 of those 4 (fields and retention) are choices you make. Asking for fewer protected fields and keeping data for less time lowers your review risk and shrinks the damage of any breach.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What Evidence Might Shopify Ask For?&nbsp;<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">While Shopify doesn\u2019t publish a centralized evidence checklist (as simple as that would have made life for vendors), its requirements do give insight into the reviewer\u2019s expectations, of which 4 items top the list:<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Pentest Report:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">For CTP, this is the primary requirement, while for a data protection review, a current report is the most direct, effective proof that your controls hold up.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A \u201cgood report\u201d hence often translates to an independent, dated analysis that states the scope and methodology, rates each finding by severity, and provides remediation guidance alongside retest evidence showing the effectiveness of your fixes. Do ensure that the scope covers your APIs, OAuth flows, webhooks, and cloud configuration, not just the front end.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Choosing a provider? See <a href=\"https:\/\/www.getastra.com\/blog\/penetration-testing\/third-party\/\">what to look for in a third-party pentest<\/a>.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Architecture Diagram:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">CTP asks for diagrams of your infrastructure showing components that handle Shopify data, data flows, security controls, cloud providers, and regions. Keep it current: an outdated diagram is worse than none.&nbsp;<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Retention Policy:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Both Level 1 and CTP expect set retention periods for personal data, and deletion or anonymization when they expire. Pair it with a data map showing where each type of data exists.<\/p>\n\n\n\n<h4 class=\"wp-block-heading\">Incident Response Plan:<\/h4>\n\n\n\n<p class=\"wp-block-paragraph\">Level 2 asks for a security incident response policy, while CTP adds a named security contact and a 24-hour breach notification to Shopify. A solid plan covers severity levels, roles, escalation routes, and evidence collection.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">You&#8217;ll also likely be asked about encryption and key management, access controls, MFA, backup restore tests, your vulnerability and patching records, a privacy policy or data protection agreement, and, for CTP, load-test results refreshed each annual cycle.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">If the Request Comes after an Incident:<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">In case the request comes after a security incident, Shopify emails the business address on your Partner account with a ticket number, and asks you to respond directly to that email. It will not share details of its investigation, and the notice explains how to appeal.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Teams in the position often tell us they have been asked for an incident response report alongside a third-party pentest report. Shopify\u2019s public docs do not spell that out, as it differs case-by-case, so confirm what your notice requires before you commission anything.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Pro Tip: Rotate or revoke exposed keys &amp; tokens first, then test, fix, and retest. For the full playbook, see our guide to getting an app relisted.<\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Does_Shopifys_Bug_Bounty_Cover_Your_App\"><\/span>Does Shopify\u2019s Bug Bounty Cover Your App?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">TL;DR: not for your rewards.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Shopify runs a public bug bounty, so it is easy to assume researchers are already testing your app for free, even when they aren&#8217;t\u2014at least not for a reward.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">The <a href=\"https:\/\/www.shopify.com\/bugbounty\/criteria\" target=\"_blank\" rel=\"noopener\">program criteria<\/a> say vulnerabilities in third-party apps go to the responsible developer first; i.e. a researcher may report to Shopify only if the developer does not respond within a week. Even then, Shopify \u201cwill not pay a bounty for vulnerabilities in third-party apps\u201d and closes the report as informative, which, in other words, means Shopify-developed apps are in scope for reward; yours may not necessarily meet that criteria.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Here is what that leads to:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>No one is paid to find your bugs:<\/strong> your app has no bounty coverage, so the only independent assessment you get is the one you commission<\/li>\n\n\n\n<li><strong>Reports reach you directly, or not at all:<\/strong> that is why CTP requires a public security contact and remediation timelines, and why its support rules treat customer-reported security vulnerabilities as critical requests, with a first response due within 30 minutes<\/li>\n\n\n\n<li><strong>A bounty program is not proof:<\/strong> nothing in Shopify\u2019s program produces a report you can hand to a reviewer<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Verdict: bug bounty at its best is a safety net for Shopify\u2019s own products, NOT for yours.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">What do Merchants Need to Do?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">Simply put, the same thing you always did as a merchant. If you run a store rather than build an app, these app requirements do not apply to you directly, but the responsibility for your store stays with you.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/help.shopify.com\/en\/manual\/privacy-and-security\/privacy\/international-data-transfers\/merchant-responsibilities\" target=\"_blank\" rel=\"noopener\">Shopify\u2019s help center<\/a> says you are responsible for operating your store and for regulatory compliance, including the privacy duties that come with the apps you use. In practice, that comes down to 3 things:<\/p>\n\n\n\n<ol class=\"wp-block-list\">\n<li><strong>Vet the apps you install:<\/strong> review permissions and privacy policies, since apps that handle orders can reach customer data<\/li>\n\n\n\n<li><strong>Remove apps you no longer use:<\/strong> uninstalling revokes access, and after 48 hours Shopify also <a href=\"https:\/\/help.shopify.com\/en\/manual\/apps\/finding-choosing-apps\" target=\"_blank\" rel=\"noopener\">sends the developer a request<\/a> to erase the customer data the app collected<\/li>\n\n\n\n<li><strong>Test your custom code:<\/strong> custom apps, headless storefronts, and integrations are yours to secure<\/li>\n<\/ol>\n\n\n\n<p class=\"wp-block-paragraph\">Running a store with custom builds? See our guide to Shopify store pentesting.<\/p>\n\n\n\n<h3 class=\"wp-block-heading\">How Often Should You Pentest a Shopify App?<\/h3>\n\n\n\n<p class=\"wp-block-paragraph\">The direct answer: annually, after any and all major releases + before your certification cycle.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Shopify\u2019s requirements, like any other platform, are far from static, whereby not only are they subject to change, but Partners are expected to update their apps to meet new ones within a reasonably stipulated timeline.&nbsp;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Three triggers usually keep you covered on the security front:<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li><strong>Annually:<\/strong> this is the minimum for CTP, and a sensible baseline for any app that handles merchant data<\/li>\n\n\n\n<li><strong>After major releases:<\/strong> Shopify does not prescribe this, but retest when you change something that alters your attack surface, such as OAuth or session flows, API scopes or protected fields, webhooks, cloud infrastructure, or major dependencies<\/li>\n\n\n\n<li><strong>Before your certification cycle:<\/strong> finish testing, fixing, and retesting well ahead of renewal, and start 60 to 90 days early if you can. Shopify also asks CTPs to refresh load tests every annual cycle, so plan both together<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Scheduled automated scans and autonomous pentests in between releases catch regressions that a once-a-year test cannot. Thus, your annual pentest then confirms a clean state instead of detecting a backlog.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"768\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2025\/08\/36a66bec-astra-dashboard-scan-schedule.png\" alt=\"Astra Security's unified platform offers scan scheduling for a balanced, more nuanced approach.\" class=\"wp-image-40092\"\/><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"Need_independent_proof_for_Shopify_Start_here\"><\/span>Need independent proof for Shopify? Start here&nbsp;<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">The pattern throughout the guidelines is consistent: Shopify\u2019s programs ask you to be secure, and when something goes wrong, or when you apply for CTP, they ask you to show it. By then you want a report in hand, not a procurement process running from pillar to post for an engagement letter praying for an extension.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">A pentest built for Shopify apps should test what reviewers and attackers care about: your merchant dashboard, REST and GraphQL APIs, OAuth flows, webhooks, token handling, and cloud configuration. It should end in a report with severity-rated findings and remediation guidance, and a retest that proves your fixes worked.<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><img loading=\"lazy\" decoding=\"async\" width=\"1507\" height=\"1600\" src=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/01\/69030f77-image.png\" alt=\"Astra Security's automated DAST tool + VAPT platform dashboard\" class=\"wp-image-45051\" srcset=\"\/cdn-cgi\/image\/quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/01\/69030f77-image.png 1507w, \/cdn-cgi\/image\/width=1447,height=1536,fit=crop,quality=80,format=auto,onerror=redirect,metadata=none\/https:\/\/cdn-blog.getastra.com\/2026\/01\/69030f77-image.png 1447w\" sizes=\"auto, (max-width: 1507px) 100vw, 1507px\" \/><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">That is what we do at Astra. <a href=\"https:\/\/www.getastra.com\/ptaas\">Astra Pentest<\/a> gives you two ways to get proof: <a href=\"https:\/\/www.getastra.com\/autonomous-pentesting\">autonomous pentesting<\/a>, where AI agents chain findings and test business logic across your web app and APIs, and manual pentests led by certified human pentesters. Use either alone or both together, then rescan your fixes and get a security certificate when you pass, with CI\/CD integrations and real-time expert support throughout.<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Findings come with remediation guidance, fixes are rescanned, and you get a report and pentest certificate you can use as independent evidence. Ready to see how your Shopify app holds up? <a href=\"https:\/\/www.getastra.com\/contact-us\"><strong>Talk to us about application penetration testing for Shopify apps \u2192<\/strong><\/a><\/p>\n\n\n\n<h2 class=\"wp-block-heading\"><span class=\"ez-toc-section\" id=\"FAQs\"><\/span>FAQs<span class=\"ez-toc-section-end\"><\/span><\/h2>\n\n\n<div id=\"rank-math-faq\" class=\"rank-math-block\">\n<div class=\"rank-math-list \">\n<div id=\"faq-question-1793033734515\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Does Shopify require a pentest for apps?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Only for CTP, who must complete an annual independent third-party pentest following OWASP and NIST methodologies. The Shopify App Store requirements, protected customer data requirements, and Built for Shopify requirements do not name a pentest, though they all expect your app to be secure.<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1793033747474\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>What are the Shopify App Store security requirements?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Shopify reviews 5 areas before publishing: protection against common web vulnerabilities including the OWASP Top 10, TLS encryption, closed network service ports, secure token generation, and careful handling of shortened URLs. It also requires only the access scopes your app needs, meaning apps with vulnerabilities are rejected until fixed.\u00a0<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1793033759914\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Do the Built for Shopify requirements include a pentest?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>No, Built for Shopify requirements cover performance, design, and integration, and require you to keep meeting App Store requirements and stay in good Partner standing. Shopify reviews BFS apps annually, giving 60 days to fix failures. CTP is a separate program with its own pentest rule.\u00a0<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1793033773303\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>Is the Shopify Plus certified app program the same as Certified Technology Partner?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Not anymore; Shopify retired the Plus Certified App Program brand in December 2025 in favor of the Certified Technology Partner Program. The CTP requirements, including the annual third-party pentest and 18 security controls, are the ones to follow now.\u00a0<\/p>\n\n<\/div>\n<\/div>\n<div id=\"faq-question-1793033786163\" class=\"rank-math-list-item\">\n<h3 class=\"rank-math-question \"><strong>My app was delisted after a security incident. What should I do?<\/strong><\/h3>\n<div class=\"rank-math-answer \">\n\n<p>Contain the exposure by rotating leaked keys and tokens, then reply to Shopify\u2019s ticket email and ask what evidence it needs. Fix, retest, and submit your proof. Teams in this position commonly need incident documentation and independent testing evidence, so check what your notice requests.<\/p>\n\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>Key Takeaways Shopify App Store requirements have a lot to say about app security, and almost none of it says \u201cget a pentest.\u201d Dig through the App Store review rules, the protected customer data requirements, the Built for Shopify criteria, and the Certified Technology Partner list, and you\u2019ll find only one program that mentions penetration &#8230; <a title=\"Shopify App Store Requirements: Do You Need a Pentest?\u00a0\" class=\"read-more\" href=\"https:\/\/www.getastra.com\/blog\/penetration-testing\/shopify-app-store-requirements\/\" aria-label=\"Read more about Shopify App Store Requirements: Do You Need a Pentest?\u00a0\">Read more<\/a><\/p>\n","protected":false},"author":111,"featured_media":49853,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[722],"tags":[],"class_list":["post-49847","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-penetration-testing"],"_links":{"self":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49847","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/users\/111"}],"replies":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/comments?post=49847"}],"version-history":[{"count":1,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49847\/revisions"}],"predecessor-version":[{"id":49854,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/posts\/49847\/revisions\/49854"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media\/49853"}],"wp:attachment":[{"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/media?parent=49847"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/categories?post=49847"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.getastra.com\/blog\/wp-json\/wp\/v2\/tags?post=49847"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}