Shopify adds app security check to CLI in AI toolkit

Shopify has launched a new app security check command in its Shopify CLI as part of its Fall '26 Edition update.

Part of Shopify's AI Toolkit, the command is designed to help developers identify security issues in their own code. It checks for common vulnerability patterns, including unauthenticated routes, cross-shop data access and unverified webhooks.

Developers can use the tool alongside an AI coding assistant to work through potential fixes. The command is intended to complement existing security tools and reviews, not replace them.

The release comes as the eCommerce group broadens a set of product changes aimed at merchants, developers and shoppers. Several of the updates focus on AI-based shopping, payments and in-store retail operations.

Ben Homer, Solutions Engineering Lead at Shopify, said businesses are operating in a more demanding commerce environment.

"Commerce is changing rapidly. It's advancing, but not necessarily in a straight line," Homer said.

He added that businesses now face a wider range of operational pressures across sales channels, customer expectations and international trading.

"To succeed in this moment and in the future, businesses need to sell across more surfaces, respond to higher customer expectations, navigate ever-changing AI solutions, run a global operation, and maintain margins across cost of goods sold, labor, pricing, and overhead," Homer said.

Broader update

Beyond developer tooling, Shopify used the latest edition of its product showcase to outline a broader push into AI-assisted commerce. Among the additions are expanded connectors that let merchants link Shopify with several AI agents used for tasks such as managing products, inventory, orders and performance.

Those connectors now work with nine agents, including ChatGPT, Claude, Copilot, Gemini and Perplexity. Shopify also updated Sidekick, its AI assistant for merchants, with functions such as running calculations, writing code, searching the internet and remembering merchant preferences.

Another part of the release centres on Shop, Shopify's consumer-facing shopping product. Shop now has a web presence through Shop.com, where shoppers can browse posts, editorial selections and personalised sections.

Shopify also introduced a single checkout in the Shop app for baskets containing goods from multiple merchants. The process still respects each merchant's checkout extensions and validations.

Payments and fraud

On payments, Shopify expanded its discussion of fraud prevention through Shopify Protect, a set of risk and dispute tools available in the admin interface. Merchants can write and test their own fraud rules through a Rule Builder.

Signals from millions of businesses are used to inform Shopify's fraud defences. Shopify Payments also prevents more than 12,000 high-risk payments every minute for merchants using the service.

Shopify is also extending Shop Pay into AI-driven shopping flows. Shoppers can use Shop Pay checkout inside certain personal AI agents, while developers can build on the underlying Shop tools through shop.dev without requiring a key.

Store and till

In physical retail, Shopify updated its point-of-sale system with tools intended to help staff recognise more in-store customers. When shoppers choose a digital receipt and share their details, the system can save their information to a customer profile linked to the purchase.

Known in-store customers have more than 60% higher lifetime value than unknown shoppers, according to Shopify. The company also introduced a recent carts feature that allows sales staff to begin a transaction on one device and complete it on another.

Shopify framed the updates as part of a broader effort to link merchant operations, shopper activity and developer tools more closely across its platform.

"With every business, product, and shopper, the effects compound. Our latest iteration of innovation for both merchants and developers demonstrates that all of Shopify together is exponentially more capable because everything is connected," Homer said.