# Shopify app code audit and security review > A fixed-fee Shopify app code audit. Webhooks, session tokens, shop isolation, scopes, and API versions, with a plain-English plan for what to fix first. - URL: https://velocitylabs.io/code-audit/shopify-app/ Shopify app code audit # A Shopify app code audit before Shopify, or a merchant, finds the problem. One Shopify app usually serves many stores, so the costliest bugs are the ones that let one shop reach another shop's data or token. We review your app's code against the problems Shopify apps actually have, and tell you in plain English which ones matter and what to fix first. ## What a Shopify app code audit checks Every Shopify app audit covers the eight areas in every code audit, plus checks written for Shopify apps. - ### One shop, one shop's data Queries and Admin API calls that take the shop from the request instead of the verified session, and records, settings, or tokens that one store could reach for another. - ### Session tokens and install flow Embedded app routes that skip ID token (session token) checks, hand-rolled OAuth and token exchange, loose shop domain validation, open redirects, and missing frame-ancestors headers. - ### Webhooks and app proxies HMAC verification on every webhook and signature checks on app proxy requests, plus handlers that run twice on a retry or let an older update overwrite a newer one. - ### Access tokens and scopes Tokens stored in plain text, logged, or sent to the browser, the move to expiring offline tokens, and requested scopes the code never uses. - ### Compliance and customer data The mandatory GDPR compliance webhooks (and whether they actually delete or export the data), cleanup on uninstall, and customer data kept longer than the app needs it. - ### Extensions, API version, and libraries Unescaped settings and metafields in theme app extensions, leftover ScriptTag code, GraphQL rate limits, an old Admin API version or REST calls, and Shopify libraries behind current. ## More than a security scan Every audit runs Semgrep and the scanners for your app’s language, and reads your code against the security checks Shopify publishes for apps. But scanners only find the patterns they know. The findings that hurt most in Shopify apps are usually ones a scanner can’t see: - A settings save that trusts a `shop` parameter from the browser - A webhook body parsed before its HMAC is checked, so the check proves nothing - A `shop/redact` handler that returns 200 and deletes nothing - An `orders/create` retry that creates the same record twice Those come from reading the code, the way a reviewer would. ## Shopify app code audit pricing Three levels, each a fixed fee. Essentials covers the most important Shopify checks; Standard and Comprehensive cover all of them. [See everything every audit includes](https://velocitylabs.io/code-audit/). ### Essentials A fast health check **$1,000** fixed fee **Best for:** Answering "is this codebase OK?" before you buy, hire, or launch. - Review of your code, configuration, CI, and database schema - Automated scans for security issues, vulnerable and outdated dependencies, leaked secrets, and code quality - The essential checks for each technology in your stack - Critical and high findings written up in full ### Standard A thorough review **$1,500** fixed fee **Best for:** An inherited codebase, a pre-launch review, or before hiring a team. Everything in Essentials, plus: - Every check for each technology, not just the essentials - Your app and tests running in our isolated environment - How your team ships, when the code comes with its git history - Every finding written up in full ### Comprehensive Due diligence depth **$2,500** fixed fee **Best for:** Acquisitions and technical due diligence, compliance preparation, or after an incident. Everything in Standard, plus: - Line-by-line review of sign-in, payments, and data access - Steps to reproduce every finding - Your public website: accessibility, search visibility, and security headers - Domain and email setup: DNS, SPF, DKIM, and DMARC ## Is your app on a supported API version? Shopify releases a new Admin API version every quarter and supports each one for at least 12 months. When an app calls a version that’s no longer supported, Shopify quietly serves the oldest supported one instead, which can change how your app behaves without warning. Every Shopify app audit checks your pinned API version, REST calls, and Shopify libraries. Public apps also face deadlines: expiring offline tokens are required for all public apps from January 1, 2027. If you’re behind, the report lays out the path one step at a time, libraries first. When you’re ready, we can do the [upgrade](https://velocitylabs.io/maintenance/) too. _Admin API versions today Latest: 2026-10_ - 2026-10Supported ReleasedOct 1, 2026 Supported untilOct 16, 2027 - 2026-07Supported ReleasedJul 1, 2026 Supported untilJul 16, 2027 - 2026-04Supported ReleasedApr 1, 2026 Supported untilApr 16, 2027 - 2026-01Supported ReleasedJan 1, 2026 Supported untilJan 16, 2027 - 2025-10Unsupported ReleasedOct 1, 2025 Supported untilEnded Oct 16, 2026 Checked November 13, 2026 against the [Shopify API versioning](https://shopify.dev/docs/api/usage/versioning). ## Other stacks we audit Every code audit covers the eight areas on our [code audit page](https://velocitylabs.io/code-audit/). These have their own checklists too. - [Rails](https://velocitylabs.io/code-audit/ruby-on-rails/) - [Laravel](https://velocitylabs.io/code-audit/laravel/) - [Python](https://velocitylabs.io/code-audit/python/) - [Node.js](https://velocitylabs.io/code-audit/nodejs/) - [Mobile apps](https://velocitylabs.io/code-audit/mobile-app/) ## Questions about Shopify app code audits #How much does a Shopify app code audit cost? The same fixed fees as every audit: $1,000 for Essentials, $1,500 for Standard, and $2,500 for Comprehensive. [Compare the levels](https://velocitylabs.io/code-audit/shopify-app/#pricing). Hire us for hourly development within 30 days of your report and up to $1,000 of the fee comes off your first invoice. #Will an audit help us pass App Store review? It covers much of what review looks for: compliance webhooks, webhook verification, session tokens, scopes, and the security checks Shopify publishes. It can’t guarantee approval, and we recommend you also run Shopify’s own `shopify app security check` before each release. #Do you need access to our store or Partner account? No. We review a copy of your code in an isolated, disposable environment. We never install the app on a store, and never connect to your production servers, databases, or accounts. #Do you audit custom apps as well as public apps? Yes. A custom app built for one merchant gets the same review, minus the requirements that only apply to public apps, like App Store review and the expiring token deadline. #Which Shopify app stacks do you audit? The React Router app template and its Remix predecessor, apps built on Shopify’s Node, Ruby, PHP, or Python libraries, and hand-rolled apps, along with their theme app extensions, UI extensions, and Functions. #Can you fix what the audit finds? Yes. We can work alongside your team or take it on ourselves, and the audit credit applies.