Aug 11, 2026 Even Shopify's own HMAC check had a bug — go update
Shopify disclosed GHSA-3h8r-q86m-44c7: an HMAC validation bug in App Proxy request verification across @shopify/shopify-api and the official app templates. Moderate, no known exploitation, one fix — upgrade.