Shopify called on all app developers on October 20, 2026, to run security checks and tighten access controls this week, without setting an exact cutoff. It also asked developers to begin migrating to expiring tokens, which the company says will soon become mandatory for public apps. Sources: Shopify
The AI Toolkit security check targets routes that lack authentication, cross-shop data access and webhooks whose authenticity has not been verified. Shopify says most early-access partners found previously unknown issues but gives no sample size or percentage. Sources: Shopify
Development agency Dev Partners reported on October 16, 2026, that Shopify announced the tool on October 15, 2026. It describes a local scanner paired with coding-agent investigation and reports 36 checks classified by severity: 25 high, 9 medium and 2 low. Those figures classify checks, not discovered flaws; the agency says coverage varies by app template, while business logic and infrastructure need separate review. Sources: Dev Partners Ltd
Shopify also plans tighter boundaries for storefront code, IP restrictions and higher App Store security requirements, with implementation timelines to follow. Developers must report suspected security issues immediately, fix problems and notify affected merchants, the company says. Sources: Shopify
What to do
- Run the AI Toolkit security check this week, scan apps and endpoints, and sanitize rendered data.
- Inspect API logs by client IP for suspicious activity.
- Enable two-step authentication, remove obsolete access and update emergency contacts.
- Begin migrating public apps to expiring tokens ahead of Shopify’s planned requirement.
- Report suspected issues immediately to partner-security-reports@shopify.com, fix problems and notify affected merchants. Sources: Shopify