Ensuring great app security not only earns you the trust of your customers, it also greatly increases the long term chances of success for your business. Cyber attacks are only increasing in frequency and cost. The industry has a long, difficult road ahead, but both tooling and best practices are making headway, and we can see it making a big difference for modern apps built in this way. Building an app for the Shopify ecosystem not only provides you with a fast, high-converting platform for millions of merchants, it also ensures credit card information and customer data is protected. Shopify is PCI compliant and handles the whole checkout. Credit card information is sent directly to Shopify for them to handle, which alleviates you and your app users from the burden of full PCI compliance. That doesn’t mean you don’t still have to be careful when developing your Shopify apps. Basic web application security principles apply, and as the Shopify ecosystem grows, we have to be continuously vigilant in ensuring we uphold the security of our apps on the platform. When new functionality is introduced, it can sometimes mean we have to think about using customer data more carefully—such as if we’re sending it to an artificial intelligence (AI) engine for recommendations. Common web application flaws are often dealt with by using modern frameworks, like SQL injection—a method of breaking out the confines of a poorly constructed query and interacting with the database in unwanted ways. If you’re turning your legacy app into a Shopify app, you may have to spend a considerable amount of time checking and improving the codebase to meet modern security standards. Contracting an external penetration testing company or consultant is worth the investment, as this means you’re not “marking your own homework.” Developers can often be blind to their own security missteps. A key challenge to consider when developing a Shopify app is the handling of Personally Identifiable Information (PII), especially in areas where you’re requesting your client’s customer information. One small mistake in this area can cost you the trust of your users, and damages the trust in the Shopify app ecosystem as a whole. Make sure you check through the requirements for public apps, which include GDPR compliance, having a privacy policy, and responding to deletion requests. In this article, we will cover 11 key areas you need to consider to ensure you’re building a secure Shopify app. Now that you know why it’s important, let’s explore the details. 1. Always use source control When starting to build a new application, it’s important to use source control. It’s not only helpful to collaborate with other developers, but it also allows you to track and monitor changes. Using source control allows you to start automating the deployment and build process, which reduces the potential for human error. If you’re manually going through any steps to get your application live, it increases the likelihood of something going wrong. Ideally, all your infrastructure would live as code. If you use AWS, that could be orchestration tools such as CloudFormation or Terraform. In Heroku, this would be your buildpack. In modern, low-config deployment environments like Vercel, a lot of best practices are built in by default. 2. Environment variables You should keep all secrets, like your Shopify keys, out of your codebase. This makes it easier to work on your code with other developers, and if your code were to ever be leaked, hackers wouldn’t have access to third-party services, databases, etc. In your local development environment, it’s best practice to run completely different instances of third-party services that you use, set them up specifically for development, and then put these in a .env file in the root of your project, which is ignored from your source control. You can add a .env.example to your repo as well to show which variables need to be configured. Starting a project wit...