Shopify App Security Audit: 7 Checks Every Store Owner Should Run

On October 13, 2026, some Shopify stores sent their customers to a fake payment page. The store owners hadn’t installed anything new that day. The bad code arrived through two apps they already trusted.

According to iTnews, an attacker got into an internal tool at Logbase, the company behind the Selleasy upsell app, and added a script to the Selleasy settings of a number of stores. Separately, the Hulk Product Options theme extension was altered, and Shopify temporarily disabled it. The script caught clicks on the checkout button and sent shoppers to a lookalike payment page. It ran for about seven hours.

One store only found out because a customer took screenshots of the strange checkout and sent them to the owner.

That’s the part worth sitting with. You can do everything right on your own store and still get hit through a vendor. So I run the same short audit on every store I work on. Here it is.

Why apps are the weak spot

Every app you install gets some access to your store. Many also put code on your storefront, through an app embed, a theme app extension or, on older apps, a snippet pasted into your theme.

That code is loaded from the app developer’s servers. If their systems are compromised, or a setting is changed on their side, your storefront changes too. You don’t get a notification. Nothing in your theme files looks different.

You can’t control what happens inside an app company. You can control how many apps can touch your store, and how fast you’d notice when one goes wrong.

Check 1: Click your own checkout button

This is the two-minute test, and most owners have never done it.

1. Open your store in a private (incognito) browser window.
2. Add any product to the cart.
3. Click checkout.
4. Look at the address bar.

You should land on your own domain’s checkout or a Shopify checkout URL. Anything else is an incident.

Two details matter here. Security researcher Roman Zipp found the October script was built to fire only once per browser session, then let shoppers through to the real checkout. And it didn’t work in every browser. So:

• Use a fresh private window every time.
• Test on a phone as well as a laptop.
• Run the test weekly, and again after any app install or update.

Put it on a recurring calendar reminder. It’s the cheapest monitoring you’ll ever set up.

Check 2: Review your app embeds

In your admin, go to Online Store > Themes > Customize, then open App embeds in the left sidebar.

Every toggle there is an app loading code on your storefront. Go down the list and ask one question for each: do I still use this app?

If the answer is no, or you don’t recognise the name, switch it off. Then check the storefront still works. Most embeds can be turned off without breaking anything, and you can switch them back on in seconds.

Check 3: Remove the apps nobody uses

Go to Settings > Apps and sales channels and list every installed app.

Most stores I audit have at least a few apps from an old campaign, a trial that was never cancelled, or a feature someone replaced. Each one is still a door into the store.

For each app, note:

• What it does and who on your team uses it
• Whether it puts anything on the storefront
• When it was last actually needed

Uninstall anything that fails that test. Fewer apps also means a faster store, so this pays off twice.

Check 4: Look at what each app can access

Click into each remaining app and review its permissions. Shopify shows what data an app can read and change: products, orders, customers, themes and so on.

Look for mismatches. A size chart app shouldn’t need to edit your theme and read customer data. A review app may need orders, but probably not to change them.

If an app asks for far more than its job needs, contact the developer and ask why, or find an alternative that asks for less.

Check 5: Find leftover theme code

Uninstalling an app doesn’t always remove its code. Older apps often pasted snippets straight into your theme, and those stay behind after the app is gone.

In Online Store > Themes, choose Edit code on your live theme and look through:

• The snippets folder for files named after apps you no longer use
• theme.liquid for {% render %} tags or <script> tags pointing at app domains
• Any assets files that obviously belong to an old app

Before you delete anything, duplicate the theme so you have a backup. Then remove the leftover code and test the pages it touched.

If you’re not comfortable in the code editor, this is a good job to hand to a developer. It’s usually an hour of work, and it’s the part most audits skip.

Check 6: Know how to reach every app that touches your storefront

When something goes wrong, you don’t want to be hunting for a support email.

Make a simple list of every app that loads code on your storefront, with:

• The developer’s support email or contact page
• Where they post status updates or security notices
• The date you last reviewed it

Keep it somewhere your whole team can find it. It turns a panicked hour into a five-minute job.

Check 7: Write a one-page incident plan

The store in the iTnews story had to decide quickly, with little information. A short plan written in advance makes those calls much easier.

One page is enough. Cover:

• Who decides. One person who can put the store into password protection without waiting for approval.
• How to close the store. The exact steps to turn on password protection.
• Who to contact. Shopify Support, the app developer, and your developer or agency.
• What to tell customers. A short draft message for anyone who may have entered payment details on a fake page.
• How to reopen. Shopify told the affected store to keep password protection on until it confirmed things were clear. Wait for that confirmation.

Write it once, review it twice a year.

How often to run this audit

• Weekly: Check 1, the checkout click test.
• After every app install, update or removal: Checks 1, 2 and 5.
• Every quarter: The full audit.

It sounds like a lot written out. In practice, the quarterly audit takes an hour or two on a typical store, and the weekly test takes two minutes.

FAQ

Can a Shopify app redirect my checkout?

An app that loads code on your storefront can change what happens when a shopper clicks a button, including the checkout button. That’s what happened on October 13, 2026. The checkout itself runs on Shopify, but the click that leads to it happens on your storefront.

Do I need to remove an app’s code after uninstalling it?

Apps that use app embeds or theme app extensions are removed cleanly by Shopify. Older apps that pasted code into your theme often leave snippets behind, and you need to remove those by hand.

How do I know if my store was affected by a malicious app?

Run the checkout test from Check 1 in several private windows and browsers, follow notices from your app developers, and take customer reports of odd checkout pages seriously. If you find anything, turn on password protection and contact Shopify Support.

How many apps is too many on a Shopify store?

There’s no fixed number. The rule I use: every app should have a clear owner on your team and a job it still does. If you can’t name both, it should go.

Want a second pair of eyes?

I run app and theme security audits for Shopify stores: app access review, storefront code cleanup and a written incident plan you can actually use. If you’d like me to go through your store, get in touch.

If you’re an agency that wants this done for your clients under your own brand, that’s what we do at Betatech.