Issue 255 - Shopify's Security Response, Theme App Add-ons, and Polaris 2.0 Goes Stable

Offline token deadline: delisting January 1, admin warnings January 15, 403s April 1

The updated timeline keeps January 1, 2027 as the migration deadline for public apps that call the Admin API: non-compliant apps are delisted and blocked from new installs that day, merchants see admin warnings from January 15, and affected requests return HTTP 403 from April 1. The same update ships client credentials access so a backend can mint a fresh token signed with the app's private key when it loses a refresh token, plus an Admin API IP allowlist and a network_access section in shopify.app.toml. Custom apps, merchant-created apps and online access tokens are unaffected, and Shopify recommends running shopify app security check before every release.

By Shopify

The companies in the checkout hijack respond

An update to Roman Zipp's checkout hijack report with statements from the companies involved, covering how the malicious code got injected. The campaign hit stores running HulkApps, Swym Wishlist Plus or Selleasy, and the code wasn't shipped inside the apps themselves -- it came through the app developers' APIs as JavaScript that redirected shoppers to fake checkout pages and harvested card data.

By Roman Zipp

Wiring Shopify's CLI security scanner into GitHub Actions

Shopify now ships a security scanner inside the Shopify CLI, and this field guide wires it into GitHub Actions so it runs on every pull request and blocks risky merges without a reviewer remembering to invoke it. It covers the workflow configuration, what the scanner does and does not catch, and where to hand its judgment calls to an agent before release.

By Very Bad Panda

Protecting Shopify theme app extensions from script injection

Kirill Platonov wrote up defensive patterns for theme app extensions in direct response to the injection campaign, starting from one assumption: your rendered output is an attack surface. The post covers how app extension output reaches the storefront, why merchant-editable or remotely fetched content is the weak link, and what to change in your extension code and config to limit the blast radius. His warning is blunt -- lots of apps are already affected and have been delisted, so review your theme extensions and app code now.

By Kirill Platonov

Partner Town Hall, Nov 5: partnerships, product, and a CISO

Shopify's next Partner Town Hall is November 5 at 10:00 am ET. The lineup: VP of Partnerships Atlee Clark, VP of Product Eytan Seidman, and Chief Information Security Officer Andrew Dunbar. The CISO slot is the tell -- it lines up with the app security changelog published the same day, so expect the vulnerability-scanning push to be a real topic rather than a footnote. RSVP is open and questions can be submitted ahead of time.

By Shopify

Theme developers can bundle app add-ons with a Theme Store listing

Theme developers can build storefront apps on theme app extensions and attach them to a Theme Store listing, monetized through Shopify App Pricing. Merchants see app add-ons on the listing page and install theme and app in a single flow. One add-on per theme with unlimited reuse across listings, the partner org must own the app, and app add-ons get priority in the review queue.

By Shopify

Polaris 2.0 is stable -- and it won't reach your app on its own

Polaris Web Components 2.0 is now on the stable CDN channels, matching the redesigned admin frame, navigation and visual styling. The trap: polaris.js and polaris-1.js keep serving 1.1 forever and polaris.js never moves to 2.x, so nothing updates silently. You have to point your script tag at polaris-2.js or polaris-2.0.js. React Router template apps need polarisUrl set in both AppProvider and the shopifyApp server config (keep the two equal) plus @shopify/shopify-app-react-router 2.1.0 or later.

By Shopify

Apps can launch Sidekick with a pre-filled prompt via the Sidekick Launch API

Embedded apps can now call shopify.sidekick.launch({ message }) from inside the Shopify admin to open a Sidekick conversation on the merchant's behalf, with the app's prompt sent as their message. The documented pattern is an Ask Sidekick button next to a report. No action required; the Sidekick Launch API docs cover the call.

By Shopify

Checkout and Customer Account extensions can emit App Events without a backend

From API version 2027-01, Checkout and Customer Account UI extensions call shopify.appEvents.emit() to send events to Shopify with no network access and no app backend, and without an access token or shop ID. Each extension can burst 20 events and then 2 per second, and events are held on the page until the buyer allows analytics processing. Optional, no action required.

By Shopify

First look: Shopify Canvas and the end of sections plus JSON templates

Code with Chris walks through Canvas, Shopify's Sidekick-driven theme builder, and lands on the argument that matters for theme developers: if a merchant can restructure a page by describing it, hand-authored sections and JSON templates stop being the unit of work. The video looks at what Canvas generates, how the output maps onto current theme architecture, and which parts still need a developer. Worth watching before quoting the next theme build.

By Code with Chris