Shopify asked every app developer to act this week. Here's what to ask yours

What Shopify asked for

On October 20, 2026, Shopify published a post on its developer blog flagged "action required." It's addressed to app developers, but store owners should read it too. Shopify says attacks across the app ecosystem are increasing as AI gets better at finding vulnerabilities, and it asks every app developer to act on a list of steps that same week.

The list, in plain terms:

• Run Shopify's new security check. A single prompt in Shopify's AI Toolkit looks for Shopify-specific problems such as routes that don't require login, one store being able to see another store's data, and webhooks that aren't verified. Shopify says that in early access, most partners found something they didn't know about.
• Move to expiring access tokens. Short-lived tokens limit the damage if one leaks. Shopify says this will soon be required for public apps.
• Scan every endpoint with vulnerability scanners, and treat any data the app displays, including metafields, as untrusted.
• Check API logs in the Dev Dashboard for suspicious activity, starting by filtering traffic by client IP.
• Turn on two-step login for the Partner account, hosting, CDN, code repositories and email, and remove access for anyone who doesn't need it anymore.
• Keep the emergency contact current, so Shopify can reach someone who can act quickly.

Shopify also says it's adding IP address restrictions so app keys only work from the developer's own servers, tightening the boundaries for storefront app code and raising App Store security requirements. It'll share timelines before those take effect.

Why this is your business, too

An app you install, or one an agency built for you, often has broad access to your orders, customers and products. If it's compromised, it's your customers' data and your store's reputation on the line.

Shopify is clear about who carries the responsibility: if there's a security issue, the developer is accountable for fixing it and notifying affected merchants. That's a fair rule, but it only helps you if your developer is paying attention. Small app makers and freelance developers are often one or two people juggling a lot. A friendly nudge from a paying customer is often what moves security work up the list.

You're not auditing their code. You're asking whether the person who holds the keys to your store did the homework Shopify just assigned.

Which deadline applies to which app

There are two different things going on, and it helps to keep them apart.

The "act this week" steps apply to every app developer. Shopify's post doesn't limit them to public apps.

The token deadline is narrower. According to CommerceGeek's summary of Shopify's documentation, from January 1, 2027, Shopify will reject GraphQL Admin API requests from public apps that use non-expiring offline access tokens. If a public app hasn't migrated, merchants lose access to it until they re-authenticate. CommerceGeek reports that custom apps and apps created by merchants aren't affected by that particular rule.

So if your agency built a custom app just for your store, the token deadline may not apply. The security steps still do. If you use a public app from the App Store, both apply.

CommerceGeek also notes Shopify's guidance that script tags stop running on storefronts on March 1, 2027. If an older app still uses them, ask about that while you're at it.

The email to send

Here's a short message you can adapt. Keep it friendly. You want answers, not defensiveness.

Subject: Quick question about Shopify's October 20 security update >Hi [name], >Shopify asked app developers on October 20 to work through a security list this week. Since your app connects to our store, I wanted to check in. Could you let me know where things stand on these? >1. Have you run Shopify's new AI Toolkit security check on the app? Did it find anything, and is it fixed?2. Does the app use expiring access tokens yet? If not, when will it, and does January 1, 2027 apply to us?3. Is two-step login on for your Shopify Partner account, hosting, code repository and email?4. Who on your side has access to our store's data today, and has anyone who no longer works on the app been removed?5. Is your emergency contact with Shopify current, and who should we call if something looks wrong? >No need for a long write-up. A quick reply on each is perfect. Thanks for looking after this.

If you work with several apps, send the same message to each one that has access to orders, customers or payments. Start with those, since they hold the most sensitive data.

Reading the replies

A good reply is specific. "We ran the check on October 21, it flagged one unverified webhook, fixed and redeployed the next day" tells you a lot. So does "tokens are migrated" or "we're a custom app, so the token rule doesn't apply, but here's what we did on the rest."

A worrying reply is vague or slow. "We take security very seriously" with no detail, no reply after a week, or confusion about what Shopify asked for are all signs to dig further.

If the answers don't satisfy you, you have options. You can open the app's permissions in your Shopify admin and see what it can access. You can uninstall apps you don't use. And for a custom app that matters to your business, you can bring in someone else to review it.

Keep the replies somewhere you'll find them. When Shopify announces its next round of requirements, you'll know which developers responded well.

If nobody answers

Sometimes the person who built your app has moved on, the agency has closed or the email bounces. That's a real risk on its own, because an app nobody maintains won't get fixed when the next problem appears.

In that case, find out what the app does and what it can access, decide whether you still need it, and either replace it or get it under someone's care before January. Our web applications team reviews and takes over Shopify apps, including security fixes and token migrations. Talk to us.

Related work: Spin Market.