How to Check a Shopify App Is Safe Before You Install It
Before you install a Shopify app, check seven things: what access it asks for, who built it, what recent reviews say about support, what the Built for Shopify badge does and does not tell you, whether it changes your storefront or checkout, how it handles customer data, and what happens when you remove it. Each check takes a few minutes. Together they cut most of the risk of letting a stranger’s code into your store.
This matters more than usual right now. In October 2026, attackers took control of several well-known Shopify apps and used them to send some shoppers to fake checkout pages. Shopify itself was not breached. The apps were the way in. Here is what happened, and here is how to check your own store.
No checklist makes an app risk-free. The apps hit in October were established, well reviewed and had passed Shopify’s review. What a checklist does is help you install fewer apps, give each one less access, and notice sooner when something is wrong.
1. Read the access it asks for, and ask if it makes sense
When you install an app, Shopify shows a screen listing what the app wants to see and change in your store. Most people click straight through it. Don’t.
Compare the list against what the app actually does. A size chart app needs to read your products. It has no reason to edit your orders or your theme code. A review app may need to read orders, so it knows who bought what, but it shouldn’t need to edit your checkout. If the access looks bigger than the job, ask the developer why before you install.
The access that deserves the most thought is anything that lets an app change what your shoppers see: editing your theme, adding scripts to your store pages, or changing checkout. That is the kind of access that turns one compromised app into a problem for every customer who visits. Our guide to Shopify app permissions explains what each one lets an app do.
2. Find out who built it
Scroll to the developer section of the App Store listing and look for:
- A real company name, website and contact address.
- How long the developer has been on the App Store, and what else they have built.
- A privacy policy you can actually read, not a placeholder page.
- A support channel that a person answers.
A large developer with many apps is not automatically safer. A bigger company can be a bigger target, and some of the apps hit in October came from well-known developers. What you are looking for is a developer you could reach quickly, and who would tell you plainly if something went wrong.
3. Read recent reviews for how they handle problems
The star rating tells you less than you think. Sort reviews by newest and read the low ones. You are looking for how the developer behaves when something breaks:
- Do they reply to complaints, and do the replies solve anything?
- Do merchants mention slow or missing support?
- Are there reports of the app slowing down the store, leaving code behind, or changing things without asking?
When we analysed 2,793 public reviews of 67 customer service and chatbot apps on the Shopify App Store, support quality was the most common complaint. It matters for security too. In an incident, a developer who answers in hours instead of days is the difference between a short scare and a long one.
4. Know what the Built for Shopify badge means, and what it doesn’t
Built for Shopify is a badge Shopify gives to apps that meet its highest standards for quality, performance and design, after an extra review. It is a good sign. It means the app is built the way Shopify recommends, which usually means it uses Shopify’s own building blocks instead of injecting its own code into your theme.
It is not a security audit, and it does not mean an app can’t be compromised later. Treat it as one point in the app’s favour, not as a reason to skip the other checks.
5. Check whether it touches your storefront or checkout
Apps that only work inside your admin, such as reporting or inventory tools, can’t put anything in front of your shoppers. Apps that add something to your store pages or checkout can. Those carry more risk, because if they are compromised, your customers are the ones who see it.
For apps that do need to appear on your store, prefer ones that:
- Show up under App embeds or as app blocks in your theme editor (Online Store, Themes, Customize). You can see them and switch them off with one click, without touching code.
- Use Shopify’s current checkout extensions rather than older methods that edit checkout code directly.
- Don’t ask you to paste code snippets into your theme files.
One caution from October: in at least one case, the app embed itself was unchanged. The harmful code came from the developer’s own servers, through an app setting that accepts custom code. So an app embed is easier to see and switch off, but it is only as safe as the developer behind it. If an app offers a “custom code” setting you never use, ask the developer whether it can be turned off.
6. Ask how it handles customer data
If the app asks to see customer names, emails, phone numbers or addresses, Shopify requires the developer to request that access and meet its data protection rules. Still, ask yourself whether the app really needs it. Then read the privacy policy for three things: what data it stores, where it stores it, and whether it deletes it when you uninstall.
7. Plan how you would remove it
Before you install, know how you would get out. Some apps clean up after themselves when you uninstall. Others leave code in your theme that keeps running after the app is gone. Search the reviews for “left code” or “after uninstalling”. If the developer has a removal guide, that is a good sign.
After you install: three habits that keep risk low
- Remove apps you no longer use. An app you forgot about still has the access you gave it. Every app you remove is one less way in.
- Review your apps every quarter. Go through Settings, then Apps, and ask of each one: do we still use it, and does it still need this access?
- Keep staff access tight. Give staff and collaborator accounts only the permissions their job needs, and turn on two-step verification for everyone.
The same test applies to chat apps, including ours
Customer service and chatbot apps are a good example of matching access to the job. To answer “where’s my order?” a chat app needs to read your orders. To recommend products, it needs to read your products. Ask whether it needs anything beyond what it does for your customers, and whether it changes your checkout.
AeroChat is a chat app on the Shopify App Store, and you should judge it the same way. The install screen shows exactly what it asks for before you agree to anything. AeroChat holds the Built for Shopify badge, and you can read our reviews on the listing. If you want to see how it works for your store, start for free on the Shopify App Store.
Frequently asked questions
Are Shopify apps safe to install?
Most are, and Shopify reviews every app before it is listed. But review happens at a point in time, and an app can be compromised later, as the October 2026 attacks showed. Install only what you need, give each app as little access as the job requires, and review your apps regularly.
Does Shopify check apps for security?
Shopify reviews apps before listing them and has rules for how apps handle data and access. It can also remove apps from the App Store, which it did with the apps involved in October. That review lowers the risk but doesn’t remove it, so your own checks still matter.
What is the riskiest access an app can ask for?
Anything that lets it change what your shoppers see or do: editing your theme, adding scripts to your store pages, or changing checkout. Access to customer personal data is the next thing to think hard about.
How many apps should a Shopify store have?
There is no right number. The rule is to keep only the apps you actively use. Each extra app is more code on your store and one more company with access to your data.
