{
  "slug": "shopify-app-security-commands-check-and-review-app-source-3697a64ba141",
  "title": "shopify app security commands check and review app source",
  "tools": [
    "shopify"
  ],
  "tags": [
    "agent"
  ],
  "introduced_at": "2026-10-08T13:19:12.000Z",
  "announced_at": "2026-10-08T13:19:12.000Z",
  "effective_at": null,
  "date_basis": "source-publication",
  "status": "unknown",
  "how": {
    "incantation": "When reviewing a Shopify app for Shopify-specific security issues, run the deterministic scan, have a coding agent investigate and record its findings, then review the combined results. Use the same app-selection flags throughout; `instructions` prints the workflow and `clean` deletes stored results.",
    "examples": [
      "shopify app security check",
      "shopify app security record < findings.json",
      "shopify app security review"
    ],
    "gotchas": [
      "Version: 4.9.0",
      "--path <value>: Select the app directory; pass the same value to related commands to use the same results.",
      "-c, --config <value>: Select the app configuration; pass the same value to related commands.",
      "--client-id <value>: The app's Client ID; required with `--without-app-config`.",
      "--without-app-config: Scan `--path` without an app config file; skips config checks and requires `--client-id`.",
      "< findings.json (required): Redirect the agent's complete findings document to `record` via standard input.",
      "--print-instructions: Print coding-agent instructions without prompting how to deliver them.",
      "--check-id <value>: Show only the named check in review; repeat to select multiple checks.",
      "--all: For `clean`, delete results for every app configuration.",
      "Prerequisite: Use Shopify CLI 4.9.0 or later; the release added these commands.",
      "Prerequisite: The command scans an app source directory; results are stored under `.shopify/app-security/`."
    ]
  },
  "why_it_matters": "Review an app’s source for Shopify-specific security issues and record coding-agent findings.",
  "sources": [
    "https://github.com/Shopify/cli/releases/tag/4.9.0",
    "https://shopify.dev/docs/api/shopify-cli/app/app-security-check",
    "https://shopify.dev/docs/api/shopify-cli/app/app-security-record",
    "https://shopify.dev/docs/api/shopify-cli/app/app-security-review",
    "https://shopify.dev/docs/api/shopify-cli/app/app-security-clean"
  ],
  "rank": 0.94031,
  "judge": {
    "publish": true,
    "judge_model": "codex-cli/gpt-6-luna+typesafe/jev-1.13.0",
    "prompt_version": "extract-v7+enrich-v2+judge-v2x3+jev-publish-v1"
  },
  "review_state": "approved",
  "provenance": {
    "run_id": "wave2a-20261017",
    "verdict_id": "wave2a-20261017:wave2a-20261017-ace6dac0a81fcc98-0:gate",
    "evidence_hash": "2be2cd26171dc505b293189ca2260f6b657c87e29250c8d3dad5dbd276d4532c"
  },
  "review": {
    "draft_hash": "6c56851cf71cb258be55933effc3b65d482df7c0108969797dd37e16fbe3aa56",
    "reviewer": "publication-gate",
    "reviewed_at": "2026-10-08T13:19:12.000Z",
    "decision": "wave2a-20261017:gate",
    "reason": "3 of 3 judge runs approved with p_yes >= 0.9 (mean 0.94 >= 0.9; 2 needed) and Jev gave 0.70 (>= 0.6 needed)."
  }
}