Are the Apps You Trust With Your Store Data Safe? A Shopify App Security Checklist

By Milo TranOctober 28, 202611 min read

Store data folder connected to app tiles, two of them flagged as suspicious, labelled Are the apps you trust with your data safe?

In July and October 2026, shoppers at some Shopify stores clicked Checkout and landed on a fake payment page. In the notices the app developers published, the attackers went through an app the store had installed, not through the store's login.

Every app you install gets some access to your store, and you can check what each one has. This checklist shows what happened, what to check in your Shopify admin, and what to ask a developer before you install. At the end, we answer the same questions about TrueProfit.

Quick Recap

In 2026, attackers changed the settings of apps from at least 4 Shopify app developers so that some shoppers were sent from Checkout to a fake payment page.
Settings > Apps shows each third-party app's permissions, activity, and unused access. Remove the apps you no longer use.
The theme editor lists the app embeds on your storefront. Check the apps that act on your cart or Checkout button first.
Require two-step authentication for every staff account, not only the ones that handle payments.

What Happened in the 2026 Shopify Checkout Hijacks

In July and October 2026, attackers changed the settings of apps from at least 4 Shopify app developers. On affected stores, some shoppers who clicked Checkout were sent to a fake payment page on another domain.

Date (2026)	App	What the developer said
Jul 22	Qikify Sticky Add to Cart and Qikify Mega Menu & Navigation	An unauthorized third party could redirect some customers to a fraudulent page during their purchase. Qikify removed the scripts from affected stores the same day. (Qikify notice)
Oct 10	Hulk Product Options (HulkApps)	An exploit introduced unauthorized configurations into the app's theme extension. (HulkApps statement, as quoted by cside and Roman Zipp)
Oct 13	Selleasy (Logbase)	An attacker used a legacy internal support tool to add a script that redirected some shoppers to an external website at checkout. (Logbase notice)
Oct 14	Swym Wishlist Plus	An unauthorized change to the app's configuration loaded a script on some storefront pages. (statement collected by Roman Zipp)

Developer Roman Zipp found and traced the HulkApps redirect, and the security company cside wrote it up in an analysis published Oct 17, 2026. In cside's account, the malicious code sat in the app's configuration data, not in the app's code. The app fetched that data when a page loaded and ran it. When a shopper clicked Checkout, the code cancelled the real checkout and opened a lookalike page. It fired once per session.

Qikify's notice explains why the redirect was hard to spot. After a shopper submitted details on the fake page, they were sent back to the real checkout on the store. "Because the customer ended up on the genuine checkout afterwards, the redirect could easily go unnoticed," Qikify wrote.

When cside published its analysis on Oct 17, 2026, some things were still unknown. The root cause of the intrusions wasn't public, and no one had shown whether the incidents were linked. cside found no public source reporting a breach of Shopify itself, and Shopify hadn't published how many stores or shoppers were affected.

Why a Trusted App Can Become the Way In

When you install an app, its developer gets some access to your store. Anyone who breaks into the developer's systems can use that access too.

The 2026 notices describe this path. Logbase says the attacker "targeted a legacy internal support tool" and that "merchants' Shopify accounts and credentials were not used in the attack." Qikify says the injected content "was confined to the app settings record" and that its apps wrote no code into merchants' themes.

A strong password on your Shopify account would not have stopped these attacks. You also can't see inside an app developer's systems. What you control is:

which apps stay installed
what each app can access
what each app adds to the pages your shoppers see

The checks below cover each one, plus your staff accounts. They apply to apps you add later too, including the ones in our list of Shopify apps for ecommerce stores.

How to Check Each App's Permissions in Shopify Admin

Shopify shows each third-party app's permissions, recent activity, and unused access on the app's about page. The steps below follow the Shopify Help Center article Managing apps.

In your Shopify admin, go to Settings > Apps and open an app's about page.
Review the app's activity and permissions. You see which parts of your store the app can access and what it has done recently.
Look for an Unused access subsection. Shopify lists permissions there that the app "hasn't used in the last 30 days." If you don't use the app either, remove it as described in step 5.
Review the personal data the app can access, and open the developer's privacy policy from the same page.
Remove the apps you no longer use. Shopify's ecommerce security guide says to "regularly review which apps have access to your store, and remove any that are no longer in use."

Repeat these steps for each app in the list.

Before you uninstall, read Shopify's guide to uninstalling apps. It warns that "some apps add code to your online store theme that isn't automatically removed when you uninstall the app," and that "some apps store data that you can't recover after uninstalling." If you need an app's data, get it out before you remove the app.

Two limits apply. Shopify says app activity and permissions "are currently tracked only for third-party apps in Settings > Apps." A permission review also would not have caught the 2026 attacks on its own. In cside's analysis of the HulkApps case, the app's code was unchanged and the payload arrived as data from the developer's own API.

How to Check What Apps Add to Your Storefront

The 2026 attacks ran on storefront pages, so start with the apps that add code to the pages shoppers see. In the Qikify incident, the redirect fired when shoppers clicked the Checkout button in a cart drawer, or the Add to Cart and Checkout buttons in a menu app.

Shopify's help article on extending your theme with apps names two ways apps appear in your theme:

App blocks, which "let you add app functionality exactly where you want to use it in your theme."
App embeds, which are "app-provided elements that float or display as an overlay in your theme, or add code to your online store without being visible to your customers."

To see your app embeds, go to Online Store, click Edit theme, and select the App embeds icon in the sidebar. Each embed has a toggle and its own settings. Note the apps that act on your cart, product options, or Checkout button, and run the permission checks on those first.

Tracking pixels work differently. Shopify's developer docs on web pixels say app pixels load "in a strict sandbox environment using web workers." Features "that rely on scraping the DOM for information or attempting to write to the DOM" don't work there. That means an app pixel can't read or change the page the shopper sees. Custom pixels, the ones you add yourself, load in a lax sandbox, and Shopify says they "cannot access the top frame."

You can also test your checkout the way a shopper would. cside's advice after the HulkApps case:

Open a new private browser window, add a product, click the Checkout button, and watch the address bar.
Close the window and repeat, because the 2026 script fired only once per session.
Test from the cart drawer and on a phone too.

cside says "your checkout should stay on your own domain or your myshopify.com address."

These checks show what an app puts on your storefront. They can't show what a developer can change on its own servers, which is where the 2026 payloads were stored. Use them to decide which apps to watch and question first.

How to Secure Staff Accounts and Sign-In

Require two-step authentication for every staff member who logs in to your store, not only the people who handle payments. Shopify's ecommerce security guide says "you should enable it for all admin accounts, not just payment-related ones."

Shopify lets you require it for each person. The Help Center article on two-step authentication says "you can add extra security to your store by requiring staff members to use two-step authentication when they log in," and that "by default, required two-step authentication is recommended for new users."

Roles limit what each person can reach. Shopify lets you assign permissions to roles "to grant a user granular levels of access based on the role category." For example, a virtual assistant who only processes orders can have a role without access to apps or payment settings.

These steps protect the way into your store through its logins. They would not have stopped the Selleasy attack, where Logbase says merchants' credentials weren't used.

Questions to Ask an App Developer Before You Install

Before you install an app that adds code to your storefront or reads customer data, ask the developer the questions that the 2026 incident notices answered after the fact. The questions are ours. Each one comes from a detail in those notices.

Ask the developer	What the 2026 notices showed
Does the app add code to my storefront, cart, or checkout? Where?	Qikify's affected apps acted on the cart drawer and the Checkout button.
Who at your company can change the code or settings the app loads on my store, and how is that access protected?	At Selleasy, the attacker came in through a legacy internal support tool.
Does the app collect or store card data?	Swym said its app "does not collect, process or store card data."
If something goes wrong, where will you post a notice?	Logbase and Qikify published incident pages with timelines. Qikify also showed a notice inside the app to affected stores.

What TrueProfit Does With Your Store Data

TrueProfit connects to your Shopify store and your ad accounts to calculate profit, so we answer the same questions about ourselves. Each answer comes from our product documentation.

Question	TrueProfit's answer
Does the app add code to my storefront?	TruePixel, TrueProfit's tracking pixel, runs in Shopify's strict sandbox, where it can't change your pages. Shopify loads web pixel app extensions like TruePixel in web workers, and Shopify's developer docs say features that try "to write to the DOM" won't work there. TruePixel reads storefront events such as page views, add-to-cart, and checkout steps to match orders with ad clicks. It stores shoppers' email addresses and phone numbers from those events, and TrueProfit's reports show each store only its own pixel data. [NEED: confirm TrueProfit adds no other script or app embed to the storefront — Engineering]
Who can change what the app loads on my store?	[NEED: how access to production settings and internal support tools is controlled — Engineering]
Does the app collect or store card data?	Your card details never pass through TrueProfit when you subscribe. You pay for your plan through Shopify billing, and only the store owner can change the plan. [NEED: confirm TruePixel's checkout events carry no shopper card data — Engineering]
Who on my team can see my data?	You decide. Store owners invite team members, give each a role per store, and can change roles or remove members. Each member can open a read-only view of their own permissions.
Where would you post a notice?	[NEED: where TrueProfit would publish a security notice, and an address for reporting vulnerabilities — Engineering, Product]

After you install TrueProfit, its about page in Settings > Apps shows the same permissions and activity as any other app. To compare profit apps on features as well, see our roundup of Shopify profit tracker apps.

Install TrueProfit from the Shopify App Store and run the same checks on it.

Conclusion

Start in Settings > Apps today: open each app's about page, check its unused access, and remove the apps you no longer use. Then check the app embeds in your theme and require two-step authentication for your staff. Shopify's advice is to review app access regularly, so put the next review on your calendar.

Milo Tran

Content Marketer at TrueProfit & eCommerce Operator

Milo Tran

Content Marketer at TrueProfit & eCommerce Operator

I’m part of the TrueProfit content team, but before that, I’m an eCom nerd with 3 years of hands-on experience. I’ve done a bit of everything, but running high-performing ads and making sense of the numbers? That’s my thing. If it’s written here, it’s because I’ve lived it.

Let's Collaborate