# Very Bad Panda

> A terminal-styled security field guide that teaches Shopify app developers to secure their apps — how each attack works, and how to lock it out. Mascot: Bandit, a masked trash panda.

Each Dumpster Dive is available as clean Markdown by appending `.md` to its URL.
A single concatenated copy of every post lives at https://verybadpanda.dev/llms-full.txt.

## Dumpster Dives (attack teardowns)

- [The Unlocked Webhook](https://verybadpanda.dev/dumpster-dives/verify-webhook-hmac.md): Your app trusts any POST that looks like Shopify. Bandit noticed. Here's how he forged an order — and the six lines that stop him.

## Key pages

- [Lock the Can](https://verybadpanda.dev/lock-the-can): a guided security checklist for Shopify apps.
- [Dumpster Dives index](https://verybadpanda.dev/dumpster-dives): all attack teardowns.

## About

- Audience: Shopify app developers.
- Topics: webhooks & HMAC, OAuth, session tokens, secret storage, CSP, scopes.
- Home: https://verybadpanda.dev/