Shopify app code audit
One Shopify app usually serves many stores, so the costliest bugs are the ones that let one shop reach another shop's data or token. We review your app's code against the problems Shopify apps actually have, and tell you in plain English which ones matter and what to fix first.
Every Shopify app audit covers the eight areas in every code audit, plus checks written for Shopify apps.
Queries and Admin API calls that take the shop from the request instead of the verified session, and records, settings, or tokens that one store could reach for another.
Embedded app routes that skip ID token (session token) checks, hand-rolled OAuth and token exchange, loose shop domain validation, open redirects, and missing frame-ancestors headers.
HMAC verification on every webhook and signature checks on app proxy requests, plus handlers that run twice on a retry or let an older update overwrite a newer one.
Tokens stored in plain text, logged, or sent to the browser, the move to expiring offline tokens, and requested scopes the code never uses.
The mandatory GDPR compliance webhooks (and whether they actually delete or export the data), cleanup on uninstall, and customer data kept longer than the app needs it.
Unescaped settings and metafields in theme app extensions, leftover ScriptTag code, GraphQL rate limits, an old Admin API version or REST calls, and Shopify libraries behind current.
Every audit runs Semgrep and the scanners for your app’s language, and reads your code against the security checks Shopify publishes for apps. But scanners only find the patterns they know. The findings that hurt most in Shopify apps are usually ones a scanner can’t see:
shop parameter from the browsershop/redact handler that returns 200 and deletes nothingorders/create retry that creates the same record twiceThose come from reading the code, the way a reviewer would.
Three levels, each a fixed fee. Essentials covers the most important Shopify checks; Standard and Comprehensive cover all of them. See everything every audit includes.
A fast health check
$1,000 fixed fee
Best for: Answering "is this codebase OK?" before you buy, hire, or launch.
A thorough review
$1,500 fixed fee
Best for: An inherited codebase, a pre-launch review, or before hiring a team.
Everything in Essentials, plus:
Due diligence depth
$2,500 fixed fee
Best for: Acquisitions and technical due diligence, compliance preparation, or after an incident.
Everything in Standard, plus:
Shopify releases a new Admin API version every quarter and supports each one for at least 12 months. When an app calls a version that’s no longer supported, Shopify quietly serves the oldest supported one instead, which can change how your app behaves without warning. Every Shopify app audit checks your pinned API version, REST calls, and Shopify libraries.
Public apps also face deadlines: expiring offline tokens are required for all public apps from January 1, 2027. If you’re behind, the report lays out the path one step at a time, libraries first. When you’re ready, we can do the upgrade too.
Checked November 13, 2026 against the Shopify API versioning.
Every code audit covers the eight areas on our code audit page. These have their own checklists too.
The same fixed fees as every audit: $1,000 for Essentials, $1,500 for Standard, and $2,500 for Comprehensive. Compare the levels. Hire us for hourly development within 30 days of your report and up to $1,000 of the fee comes off your first invoice.
It covers much of what review looks for: compliance webhooks, webhook verification, session tokens, scopes, and the security checks Shopify publishes. It can’t guarantee approval, and we recommend you also run Shopify’s own shopify app security check before each release.
No. We review a copy of your code in an isolated, disposable environment. We never install the app on a store, and never connect to your production servers, databases, or accounts.
Yes. A custom app built for one merchant gets the same review, minus the requirements that only apply to public apps, like App Store review and the expiring token deadline.
The React Router app template and its Remix predecessor, apps built on Shopify’s Node, Ruby, PHP, or Python libraries, and hand-rolled apps, along with their theme app extensions, UI extensions, and Functions.
Yes. We can work alongside your team or take it on ourselves, and the audit credit applies.
Tell us about your Shopify app and we'll recommend the level that fits.