Cyber consulting
Security testing for Shopify stores, by people who build Shopify apps
Red team and blue team services for Shopify Plus stores, agencies, theme developers and app developers. We try to break into your store the way an attacker would, with your written permission, then help you close what we find.
Who it's for
Four kinds of Shopify business, four attack surfaces
Shopify Plus stores
Checkout extensions, custom pixels, a dozen apps with admin scopes, staff accounts across teams. The bigger the store, the more there is to get into.
Shopify agencies
You hold collaborator access to many stores at once. One compromised laptop or token touches every client. We test the agency as well as the builds.
Theme developers
Liquid, sections and theme app extensions run on every store that installs your theme. A leak in one snippet is a leak on all of them.
App developers
OAuth, webhooks, access tokens, customer data at rest. Shopify checks your listing, but nobody checks your backend until an attacker does.
Why now
Every app and every customization is a new way in
AI has made attacks cheap. Phishing that reads like your supplier, credential stuffing at scale, and code analysis that finds a weak spot in a theme in minutes. A Shopify store isn't one system any more. It's the platform plus every app you installed, every theme edit, every pixel, every integration, and every person with a login.
Shopify secures the platform. The rest is yours to protect, and most stores have never had anyone look.
- A theme snippet that prints customer or order data into the page source
- An app granted write scopes it never uses, with the token stored in plain text
- A webhook endpoint that never checks Shopify's HMAC signature
- An Admin API token committed to a public repository
- A staff account with Manage settings and no two-step authentication
- A custom pixel or checkout extension that sends more than it should to a third party
Red team
We attack your store the way a real attacker would
Inside an agreed scope and window, with a named contact who can stop us at any moment. The point isn't to prove we're clever. It's to find the way in before someone else does, and show you exactly how.
- External reconnaissance: what an attacker learns about your store, team and stack without logging in
- Theme and custom code review for data leaks, injection and unsafe third-party scripts
- Storefront, cart and checkout extension testing for logic flaws, discount abuse and data exposure
- App and integration testing: OAuth flows, webhooks, token handling, scopes, backend APIs
- Staff and collaborator permission abuse paths, from a low-privilege account upward
- Social engineering of your own team, only when agreed in writing and with a named sponsor
Blue team
We make the store harder to get into and faster to recover
Most clients start with a red team engagement and keep us on for this part. It's the quieter work: permissions, secrets, alerting, and a plan for the day something does go wrong.
- Permission and app scope audit, with a least-privilege plan you can actually keep
- Hardening: two-step authentication, SSO, API token rotation, secrets out of code
- Logging and alerting so a suspicious login or a new app install gets noticed the same day
- An incident response plan sized for your team, with who to call and what to pull first
- Fixing what the red team found, then a retest to prove it's closed
- A security review before a theme or app ships, so the fix happens before the release
How it runs
Five steps, and nothing is touched before step two is signed
- 1
Intro call
You tell us what you run and what worries you. We tell you honestly whether a test is worth the money yet.
- 2
Scope and legal
We agree what's in scope, the testing window and the stop conditions, then sign the documents before anyone touches anything.
- 3
Testing
Red team, blue team or both, inside the agreed window, with a daily check-in and an emergency contact on both sides.
- 4
Report
Every finding with severity, proof, the exact fix and who should do it. Written for the person fixing it, not for a filing cabinet.
- 5
Fix and retest
You fix, we retest, you get a closing letter. Access is revoked and our copies of your data are deleted.
Inside Shopify's rules
We test your assets, not Shopify's
Shopify runs a bug bounty program on HackerOne for its own platform, and we follow its rules. Our engagements are different: we test what belongs to you, on your written authorization, within Shopify's Terms of Service and Acceptable Use Policy.
Shopify on HackerOneYour store, theme, apps and integrations are in scope
Only the assets listed in the signed scope schedule, only during the agreed window, and only with the owner's written authorization. Agencies need it from each merchant.
Shopify's platform is out of scope
We don't attack Shopify's infrastructure. If we find something in Shopify itself we report it to Shopify through HackerOne, under their program rules, and tell you we did.
No denial of service, ever
Shopify's program excludes it and so do we. No load testing against a live store, no flooding, nothing that risks your uptime.
Third-party apps and themes get responsible disclosure
A flaw in someone else's app goes to that developer first, which is also what Shopify's policy asks. You get the finding and the workaround on the same day.
Customer data stays yours
We prove a finding with the minimum needed, never pull more than that, keep it encrypted, and delete it after the closing letter.
Paperwork first
The documents we sign before any red or blue team work
Testing without authorization is a crime, and testing with vague authorization is a dispute waiting to happen. So every engagement starts with the same set of documents. Read them before the intro call if you like; most clients do.
Not sure you need this yet?
Tell us what you run. If a test isn't worth it for you right now, we'll say so and leave you with three things to fix yourself.