Authorized testing · United States & Brazil
Shopify app security testing
Your app serves multiple stores. Each one needs to stay within its own boundaries. I assess your application and its integrations to check whether data, settings, and operations respect that separation.
Discuss my projectOne store is not another
Using test stores and data, I compare access to resources, settings, and exports. The app needs to establish the authorized store on the server, rather than trusting a parameter received from the interface.
Installation, sessions, and integrations
Scope may include installation and authentication flows, how sessions are tied to a store, permission handling, and integration endpoints. Where the flow is available for testing, I also check access boundaries when the store’s relationship with the app ends.
Webhooks and app operations
I examine event-receiving endpoints and how the app handles authenticity and incoming data. Operations involving charges, real orders, or customer messages need explicit exclusions or test environments in the agreed scope.
Illustrative scenario · fictional data
What this looks like in practice
Fictional example: store A changes an identifier in the app’s export endpoint and requests store B’s data. Testing checks whether the backend restricts the export to the authenticated store.
What to prepare before testing
We agree on development stores or another authorized environment, required permissions, app workflows, and fictional data. The assessment covers your app; it does not authorize testing Shopify’s infrastructure.
Do not send passwords, tokens, or customer data through the public form.
Questions about this service
Does this replace Shopify approval?
No. This is an independent security assessment of your application. It is not an official Shopify certification, partnership, or approval.
Can you test an app that is already published?
Yes, when the scope and conditions support authorized testing. I prefer reproducing workflows in test stores and environments to reduce the impact on customers.
Let’s define the scope.
Tell me what your system does and what you need assessed. After reviewing the context, I send a proposal with boundaries, deliverables, timing, and price.
Discuss my project