shopify app security commands check and review app source

Introduced 2026-10-08 · score 0.94

HOW TO USE IT

When reviewing a Shopify app for Shopify-specific security issues, run the deterministic scan, have a coding agent investigate and record its findings, then review the combined results. Use the same app-selection flags throughout; `instructions` prints the workflow and `clean` deletes stored results.

WHY THIS HELPS

Review an app’s source for Shopify-specific security issues and record coding-agent findings.

REQUIREMENTS AND LIMITATIONS

• Version: 4.9.0
• --path <value>: Select the app directory; pass the same value to related commands to use the same results.
• -c, --config <value>: Select the app configuration; pass the same value to related commands.
• --client-id <value>: The app's Client ID; required with `--without-app-config`.
• --without-app-config: Scan `--path` without an app config file; skips config checks and requires `--client-id`.
• < findings.json (required): Redirect the agent's complete findings document to `record` via standard input.
• --print-instructions: Print coding-agent instructions without prompting how to deliver them.
• --check-id <value>: Show only the named check in review; repeat to select multiple checks.
• --all: For `clean`, delete results for every app configuration.
• Prerequisite: Use Shopify CLI 4.9.0 or later; the release added these commands.
• Prerequisite: The command scans an app source directory; results are stored under `.shopify/app-security/`.

FIRST-PARTY EVIDENCE

• https://github.com/Shopify/cli/releases/tag/4.9.0
• https://shopify.dev/docs/api/shopify-cli/app/app-security-check
• https://shopify.dev/docs/api/shopify-cli/app/app-security-record
• https://shopify.dev/docs/api/shopify-cli/app/app-security-review
• https://shopify.dev/docs/api/shopify-cli/app/app-security-clean

Check the installed version and the source before using it. Entry JSON

Report a problem with this card