Application safeguards
- Shopify session tokens are validated before merchant API access.
- Public app-proxy requests require Shopify signatures.
- Merchant-owned records are scoped to the authenticated shop.
- Consent logs use server-side hashing of random tokens rather than direct customer identity.
- Script and resource URLs are validated, with HTTPS required where appropriate.
- Custom CSS is restricted to reduce unsafe constructs.
- Scanning blocks private network destinations, limits redirects and response size, and requires HTML.
- Secrets are provided through environment variables, not source code.
Production safeguards
- Use encrypted managed databases and backups with least-privilege access.
- Enable monitoring without logging secrets or raw visitor tokens.
- Maintain patching, access reviews, incident response, and recovery tests.
- Use TLS, MFA, secure deployment roles, and a focused security review before launch.
Merchant responsibilities
Protect Shopify accounts, restrict staff, review theme scripts and apps, use trusted integrations, and test consent behavior after changes.
Report a vulnerability
Email support@wsthemes.com with the affected component, reproducible steps, and impact. Do not access unrelated data or disrupt service.