Very Bad Panda raccoon logo
VERY BAD PANDA~/security-field-guide

Secure your Shopify app
before the raccoons get in.

A terminal field guide for Shopify developers. Bandit — a masked trash panda — shows you exactly how he'd rummage through your app, then how to lock the can.

$ ./lock-the-can browse dumpster dives

ls ./sections

Dumpster Dives

Deep teardowns of a single vuln class, start to exploit.

The Field Guide

OAuth, HMAC, webhooks, scopes, CSP, secret storage.

Raids

Real breach postmortems from the Shopify ecosystem.

Trap Cards

Quick gotcha tips you can act on in five minutes.

Trash Talk

Short posts, hot takes, and release notes.

Loot

Checklists, snippets, and copy-paste hardening.

tail -n 3 ./dumpster-dives

The Unlocked Webhook

Your app trusts any POST that looks like Shopify. Bandit noticed. Here's how he forged an order — and the six lines that stop him.

cat ./severity-examples

CRIT Access token in localStorage
🦝 Bandit opened DevTools and walked off with your Admin API token. It's now a permanent credential sitting in browser storage.
→ fix: keep tokens server-side; use session tokens + App Bridge for the frontend.
WARN Webhook has no HMAC verification
🦝 He POSTed a fake orders/create to your endpoint. You trusted it.
→ fix: verify the X-Shopify-Hmac-Sha256 header against your app secret before processing.
INFO Requesting write_orders you never use
Over-scoped OAuth. Every extra scope is extra loot if you're breached.
→ fix: request the minimum scopes; audit on each release.