Shopify App Security Checks Give Merchants More to Review

Shopify announced expanded app-access and security information on November 5. In Settings > Apps, merchants can review recent activity, permissions that may involve sensitive data, and checks for measures such as expiring access tokens and enforced IP restrictions.

For U.S. merchants preparing for holiday orders, the update offers a practical reason to review which apps are connected and why. Start with a written inventory so any decision can be traced to a business need.

Read the checks without overreading them

Shopify’s help documentation says the checks describe configuration, not an overall safety rating. Shopify-made apps lack the Security section. Staff viewing checks need the Manage and install apps and channels permission. An Unknown result can reflect unavailable information or a measure that is not active for the store.

A missing measure is a reason to investigate, rather than proof that an app is unsafe. Equally, configured measures do not guarantee safety.

Build a useful app inventory

Assign an owner. For each app, note who uses it, the job it performs, and who can contact its developer. An unfamiliar name should lead to an internal question before a removal decision.

Compare purpose with access. Write down why the app needs the information it can reach. For example, a tool handling fulfillment may have a clear operational reason to read order details. Ask for an explanation when the connection between access and purpose is unclear.

Check the workflow. Identify what would stop working if the app were unavailable: shipping updates, product options, subscriptions, or reporting. Record where the team would notice a failure and who would respond.

Ask specific questions before making changes

Send the developer a focused question about any unexplained check: Does this apply to our installation? If a change is planned, when will it reach our store, and will we need to do anything? Keep the answer with the inventory.

Avoid removing a business-critical app without a transition plan, as Shopify’s guidance also advises. Schedule any change around your store’s operating needs, then verify the affected customer journey and internal process.

Finish by recording a decision and review date for each unresolved item. A short list with named owners is easier to act on than a screenshot folder nobody revisits.