Shopify Asks App Developers to Harden After Hijacks

Shopify asked app developers on October 20 to run a new security check and adopt expiring tokens, after three apps sent shoppers to fake checkouts.

If you run a high-ticket Shopify store, this lands on you even though the post was written for developers. Every app that injects code into your storefront sits between your buyer and your checkout button, and a $4,000 order that detours to a card-harvesting page is a lost sale plus a chargeback headache. Here at Ecommerce Paradise I flagged the original hijacks on October 19, and this is what Shopify has said publicly since.

Below: what Shopify’s post actually requires, the timeline of the attacks, what I think it changes for your store, and a six-step audit to run before Black Friday traffic hits. If you missed the first story, my write-up on the three Shopify apps hijacked to fake checkouts has the test checklist.

When a vendor you trusted gets hijacked, your business is the one holding the liability, so the first thing to get right is the company itself. Form your LLC with Northwest, the best LLC formation service for ecommerce owners. Cheap formation sites that upsell put your home address on public filings; Northwest uses its own address on your filings and does not sell yours. Form your LLC with Northwest →

Shopify’s Oct. 20 Post Asks App Developers for 8 Security Steps

Shopify published “Securing your app, together” on its developer site on October 20, 2026. According to the post on shopify.dev, every app developer should act “this week” on a list of eight items.

The list is specific. Developers should run the new security check in Shopify’s AI Toolkit, which scans for unauthenticated routes, cross-shop data access and unverified webhooks. They should scan every endpoint with a vulnerability scanner, treat all rendered data as untrusted (including data from metafields or their own servers), and review API traffic in the Dev Dashboard by filtering logs by client IP.

Shopify also asks developers to turn on two-step authentication for their Partner account, hosting, CDN, code repositories and email, and to remove access for anyone who no longer needs it. They should keep the emergency developer email in the Partner Dashboard current. And they should move to expiring access tokens, which Shopify says “will soon be required for all public apps.”

The post puts the burden on the developer. Per Shopify, a developer who suspects an issue must notify partner-security-reports@shopify.com, fix the problem and tell affected merchants. The only explicit deadline is “this week.” Shopify names three coming changes without dates: tighter boundaries for storefront app code, IP restrictions so keys only work from a developer’s own servers, and higher App Store security requirements.

The token deadline does have a date elsewhere. A summary of Shopify’s developer changelog from Power Commerce says public apps must use expiring offline access tokens for Admin API calls by January 1, 2027. Each token lasts 60 minutes and comes with a refresh token, and apps still on non-expiring tokens after the deadline will get authentication errors. Custom apps built for a single merchant are not affected, and merchants do not need to reinstall anything.

The Oct. 20 post does not tell merchants to do anything. That is the gap this article fills.

Hulk, Selleasy and Swym: How the Checkout Hijacks Unfolded

The attack pattern, as documented by security firm cside in a post published October 17, is simple. Shoppers who clicked Checkout on affected stores were sent to a fake checkout on the domain biliing[.]top that collected card details and then forwarded them to the store’s real checkout. The malicious code was not in the app file itself. It came back as a “custom JavaScript” field in the vendor’s configuration response and ran at page load, once per browser session.

Developer Roman Zipp first reported the campaign on a store using Hulk Product Options on October 10, per his write-up, which was last updated October 21. Logbase confirmed an incident with its Selleasy app on October 13. Swym Wishlist Plus followed on October 14, according to the Ethercycle summary by Kurt Elster, published October 20.

The Selleasy window ran from 07:47 to 15:00 UTC on October 13, per Ethercycle. Selleasy has more than 49,000 active stores, but that is its install base, not a victim count. Nobody has published a count of affected stores or shoppers. By October 16 the three apps showed as unavailable in the App Store, and Tech Business News reported on October 18 that an Australian dog harness retailer, WAGD, was still closed on Shopify’s advice.

Logbase said “an unauthorised party gained access to an internal tool,” per Tech Business News. HulkApps said an exploit introduced unauthorized configurations into its theme extension, per cside, and that it hired an outside security firm. Swym has not publicly confirmed a compromise.

Delistings, Earlier Incidents and What Is Still Unknown

This was not the first time. Qikify reported injected code in its Sticky Add to Cart and Mega Menu apps on July 22, fixed the same day, per cside. A Hextom case from August was listed as resolved with no public vendor notice. The pattern is old enough that you should treat “this was fixed” as the start of a conversation with your vendor, not the end.

Ethercycle also points to a wave of delistings. Setka counted 126 delisted apps, 89 of them dated October 15, per Ethercycle. The same article stresses that a delisting is not evidence of compromise, and I want to repeat that. Apps like Rebuy and Privy appear in the reporting for different reasons, and none of them has been shown to be part of this campaign.

There is a counterpoint worth stating. Nothing published so far shows Shopify’s own checkout was breached. The attack lived in third-party app code on the storefront, and Shopify confirmed removal of the malicious code from affected stores, per Tech Business News. As of cside’s October 16 cutoff, Shopify had published no public statement on the incident, so the Oct. 20 developer post is the first Shopify guidance I could find. Root cause is still unpublished, and it is unconfirmed whether the three incidents are linked.

What Shopify’s App Security Push Means for a High-Ticket Store

Everything from here down is my read, not reported fact.

My read is that Shopify just told you where the next requirements are coming from. Expiring tokens, IP-restricted keys and tighter storefront code boundaries are all aimed at the same thing: a vendor’s internal tool or config field should not be able to rewrite what your buyers see. Those changes help, but they land on Shopify’s timeline, and the January 1, 2027 token deadline falls after Black Friday and Cyber Monday. Until then, you are the only party with a stake in the exact apps on your store.

Run the money. Hypothetically, say your store does 5 orders a day at a $2,000 average order. That is $10,000 a day. If Shopify or a processor tells you to keep the store closed for three days while an app incident is checked, that is $30,000 of paused revenue before you count refunds or disputes. I have seen no reporting on how long closures last, so treat this as a sizing exercise, not a forecast.

Counting the evidence honestly, I would not panic. Three confirmed apps, windows measured in hours and no published victim count is a contained incident so far. But the cost of being wrong is lopsided. An hour of checking costs you nothing, and a card-stealing redirect on your checkout page during the busiest six weeks of the year can cost you a processor relationship.

High-ticket stores are more exposed than low-ticket ones for a simple reason: one hijacked checkout session is worth more to a fraudster. A single stolen card on a $3,000 espresso machine order is a bigger loss and a bigger chargeback problem than the same event on a $30 phone case. Visa is also widening what counts as evidence in disputes from Oct. 24, which I covered in my breakdown of Visa’s chargeback evidence rules. Clean records of what ran on your checkout path will matter.

The hijacks fit a broader run of supply-chain scares this month. Stolen keys backdoored WordPress stores through UpdraftCentral. Separately, some Rank Math PRO downloads carried a backdoor.

If you run WooCommerce or another stack alongside Shopify, the same logic applies to every plugin you did not write. Even enterprise platforms are not immune, as the 10.0 flaw in Adobe Commerce showed this week.

Here is how I would sort the response. Treat every app that injects into the storefront of your Shopify store as a vendor you are underwriting. For each one, ask three questions: does it have a custom JavaScript or HTML field, who at the vendor can edit that field, and what happens to your store if the vendor is breached tomorrow. If the vendor cannot answer in writing, the app does not earn a slot on the checkout path. Rebuilding that stack is what my turnkey done-for-you service does for stores that would rather not babysit this themselves.

The protective layer around the store matters too. A support tool like Gorgias gives you a record of what customers reported and when, which is the evidence trail you want if a payment-page complaint shows up. Fraud screening from ClearSale will not stop a redirect, but it helps on the chargeback side afterward.

Communication is the other half. If a buyer emails to say they landed on a strange payment page, your reply speed decides whether you keep them. Set up a short template in Klaviyo or your helpdesk so your team can respond in minutes, and keep a plain-language notice ready that you can publish if an incident ever touches your store. A privacy and incident page built with Termly covers the legal wording you do not want to write at midnight.

For the bigger picture, my guide to protecting a high-ticket store as it scales covers the infrastructure side.

Customer records matter here as well. My HubSpot setup guide shows how to keep them tidy enough to find affected buyers fast. If you want the CRM itself, HubSpot has a free tier.

Want to work through your app audit with other store owners and me inside the community? Join the Skool community →

Audit Your Shopify Apps Before Black Friday: 6 Steps

Here are the six steps I would run this week, in order.

List every app that touches the storefront and cut what you do not use. In Shopify admin, open Apps, then check Online Store, Themes, Customize and the App embeds panel, and write down each enabled embed. Anything you cannot name a reason for gets switched off. My roundup of dropshipping tools by job shows what a lean stack looks like.
Open each storefront app’s settings and look for custom JavaScript, code or HTML fields. Read them without editing. Anything you did not put there yourself, screenshot and send to the vendor with a written request to explain it.
Test checkout from a fresh private window with no extensions, from the product page, cart page and cart drawer. Open DevTools with “Preserve log” on first, and look for unfamiliar domains, especially .top domains. The script fired once per browser session, so test several times and do not submit any card details.
Lock your accounts. Turn on two-step verification for every staff login, remove anyone who no longer needs access, and move your business email to something with strong admin controls such as Google Workspace. Shopify asked developers to do this on their side, and the same logic holds on yours.
Put a backup processor in place before you need it. I cover the full plan in my payment backup guide. Airwallex is one option, and it matters most when a store has to close fast.
Make the test a monthly habit and fold it into your holiday checklist. My Black Friday stress test already covers load and ads, so add a checkout redirect test to it. If you want a second set of eyes on your stack, book a discovery call and we will go through it together.

An audit costs you a couple of hours this week. A closed store in the third week of November costs far more. Pair the audit with business insurance for your ecommerce store so a vendor failure does not land entirely on your cash.

Frequently Asked Questions

Do I have to do anything because of Shopify’s Oct. 20 post?
No. The post is addressed to app developers and does not list merchant requirements. The sensible move is to audit your own apps anyway, using the six steps above.

When do expiring access tokens become mandatory?
Per a summary of Shopify’s developer changelog, public apps must use them by January 1, 2027, or their Admin API calls will fail. Merchants do not need to reinstall anything, but an app that has not migrated can show up as broken features on your store.

Which apps were confirmed hijacked?
Developers confirmed Hulk Product Options, Selleasy and Swym Wishlist Plus in October, per the Ethercycle summary. Earlier, separate cases involved Qikify in July and Hextom in August. A delisting alone does not mean an app was compromised.

Is Shopify’s own checkout unsafe?
No public report shows that. The attacks ran through third-party app code on the storefront. Shopify’s Shop Pay AI checkout bug I covered earlier was a separate issue.

How do I test my store without risking a fake purchase?
Use a fresh private window, load the product and cart pages with DevTools open, and look at where the checkout button points. Do not click through with real card details, and run the test several times because the script only fired once per session.

Where can I learn what makes a store worth protecting in the first place?
Start with what high-ticket dropshipping is. Then grab the free niches list to pick a category before you spend on tools.

Which niches are worth building a protected store in?
The high-ticket niches breakdown ranks more than 150 of them.

Want my team to build and run your high-ticket store for you? See the turnkey done-for-you service →

Check your apps today, not on Cyber Monday. Subscribe to the YouTube channel for daily breakdowns. More breaking news coming through the day.

If this was useful, these go deeper:

Trevor Fenner

Trevor Fenner is an ecommerce entrepreneur and world traveler from Seattle, Washington, and the founder of Ecommerce Paradise, a platform focused on helping entrepreneurs build and scale profitable high-ticket ecommerce and dropshipping businesses. With over a decade of hands-on experience, Trevor specializes in high-ticket dropshipping strategy, niche and product selection, supplier recruiting and onboarding, Google & Bing Shopping ads, ecommerce SEO, and systems-driven automation and scaling. Through Ecommerce Paradise, he provides free education via in-depth guides like How to Start High-Ticket Dropshipping, advanced training through the High-Ticket Dropshipping Masterclass, and fully done-for-you turnkey ecommerce services for entrepreneurs who want a faster, more hands-off path to growth. Trevor is known for emphasizing sustainable, real-world ecommerce models over hype-driven tactics, helping store owners build scalable, sellable, and location-independent brands.

He maintains homes in Seattle and Bali, spends most of the year overseas, and usually returns to Seattle for about a month each summer.