I like building stuff on the internet. Maker of Real ID for Shopify, Woo and BigCommerce - and lots of OSS you've never heard of
us-east-2
Joined July 2009
- Tweets4.6K
- Following220
- Followers905
- Likes3.5K
Pinned Tweet
2nd @Shopify app up and running 🙌
apps.shopify.com/real-id
Shopify now warns shoppers if they're leaving for another site. This helps prevent clickjacking.
Unintentionally that includes your app's storefront embedded links or redirects.
But thankfully, they have included a new app security setting to allow list your own authorized domains to bypass this warning pop-up
Here's how it works:
Listed hosts skip the warning, but Shopify still blocks any it flags as malicious.
Docs: shopify.dev/docs/apps/build/…
Learn more about how this attack worked: verybadpanda.dev/blog/fake-r…
Shopify apps can now lock their API keys to their own servers 🔐
A stolen key used to work from anywhere. Now Shopify rejects requests from IPs the app hasn't approved.
👨💻 Devs: turn it on in the Dev Dashboard
🛍️ Merchants: ask your apps if they've enabled it
New Shopify app security improvements:
1. Lock down merchant access tokens to allowed IP addresses
2. Lock down network requests to your known hosts in extensions
I dig it. Reduces risk surface area. If a token were compromised, the attacker still needs server access
T minus 1 hour till critical PHP patch release.
I wish they disclosed the affected major version(s)
Shopify is taking app security seriously too.
Breaches hurt the whole system, not just the individual apps with poor sec policies. How can you trust installing apps if you're seeing others?
Shopify's app security skill is a solid start but there's more you can do:
community.shopify.dev/t/secu…
Here's a Shopify App Security Field Guide so we can keep up with this changing landscape:
verybadpanda.dev/field-guide…
I've been publishing new guides and tactics based on what's happening in the ecosystem. Clearly the times have changed, and it's an opportunity to improve
The newest guide on how to harden your app against supply chain attacks, with new tooling available in package managers and integrations to help prevent breaches:
verybadpanda.dev/field-guide…
Finally able to build something that merchants have been asking over and over for years now.
So so excited. Can't share details now but so grateful for the opportunity
Dylan Pierce retweeted
Merchant trust is everything
Which means security is everything
Introducing `app security check`
A tool that finds common vulnerability patterns in Shopify apps
Run it with AI Toolkit
Ordered a fire pit direct from a local one man shop and manufacturer with Shop checkout to boot
Feels good man
I can't believe I missed this.
Now you can write automated tests for your Shopify UI Extensions - including POS 🤯
pnpm i --dev @shopify/ui-extensions-tester
