Loading
Loading
We use strictly necessary cookies to run this site, and analytics cookies to understand how it's used. See our Privacy Policy for details.
E-commerce security
Security testing built around how Shopify stores actually work, installed apps, custom Liquid theme code, and checkout, not a generic web scan run against every site the same way.
Shopify securitySoftware vulnerabilities are now the #1 breach starting point.
31% of retail breaches now start with a software vulnerability, ahead of stolen credentials, per Verizon's 2026 DBIR.
Shopify, Retail Cybersecurity ReportShopify secures its own infrastructure, servers, network, and PCI DSS compliance at the platform level are handled well, and that's genuinely not something a merchant needs to worry about. What's left is everything a merchant actually controls: which apps are installed and what data they can touch, what custom Liquid code has been added to the theme, who has staff access, and what third-party scripts are running on the storefront.
That merchant-controlled surface is exactly where real-world Shopify compromises happen, a rogue or compromised third-party app with excessive OAuth scopes, a logic flaw in customized checkout code, or a client-side skimming script injected through an unreviewed tracking pixel. This general pattern, malicious code injected into a checkout page to steal card data as customers type it, is documented across the e-commerce industry as web skimming and affects every major platform, not something specific to Shopify. None of it is Shopify's problem to fix on your behalf; it's the merchant's.
This is also why an assessment scoped specifically for e-commerce differs from a generic web application penetration test: the testing has to account for Shopify's own architecture, Liquid templating, the app OAuth model, and Storefront/Admin API auth patterns, rather than assuming a generic server-rendered stack.
Not unique to Shopify, these are the general web vulnerability classes that show up most often in a customized storefront and its integrations.
The #1 category in the current OWASP Top 10, staff accounts or app integrations with more access than their role actually requires, or endpoints that don't properly check who's asking.
OWASP Top 10Custom Liquid templates that render user-controlled input (search terms, review text, URL parameters) without proper escaping, CWE-79.
CWE-79Custom app or webhook integrations that fetch a URL supplied by the request itself, without validating it isn't pointed at an internal or unintended address.
OWASP SSRFAn endpoint like an order or customer lookup that trusts an ID in the request without confirming the requester actually owns that record, CWE-639.
CWE-639A Shopify assessment draws on the same testing discipline as our core services , it's not a separate product, just applied specifically to Shopify's architecture.
Beyond the uptime scan
An over-scoped installed app, an unescaped theme script, and an unverified webhook, the gaps a generic uptime or malware scan never looks for.
Auditing installed app OAuth scopes
$ GET /admin/oauth/access_scopes.json
"reviews-widget-v2", scope: write_customers, write_orders ← far more than a reviews widget needs
An illustrative walkthrough of how an engagement actually runs, not footage from a real client environment.
Shopify secures its own infrastructure and is PCI DSS Level 1 compliant at the platform level, that's real and valuable. But the merchant-controlled surface (installed apps, custom theme code, staff accounts, third-party scripts) is yours to secure, and it's exactly where real-world Shopify compromises happen.
Shopify's architecture is specific: Liquid templating instead of a traditional server-rendered stack, an app ecosystem with its own OAuth/permission model, and Storefront/Admin APIs with their own auth patterns. A generic web scan doesn't know to look at any of that.
We review what access each installed app has been granted and whether that scope is actually necessary, since an over-permissioned or compromised third-party app is one of the most common real-world entry points into a Shopify store. We don't pentest the app vendor's own infrastructure, that's outside what you control, but we assess the risk it introduces to yours.
It depends on store complexity, number of installed apps, amount of theme customization, and whether custom backend integrations exist. We scope this with you directly before quoting a timeline; see our approach to penetration testing for how we typically structure an engagement.
Talk to us about scoping an assessment around your specific app stack and theme customizations.
