Shopify pulled hundreds of apps and told developers to fix security now.
After a wave of fake-checkout attacks.

What we know

1. 01Shopify's Oct 20, 2026 developer post asks every app developer to act that week: run its new security check, move to expiring access tokens, treat rendered data as untrusted, review API logs and turn on two-step authentication.↗ shopify.dev
2. 02Shopify says it is tightening boundaries for storefront app code, adding IP restrictions for app keys and raising App Store security requirements, with details and timelines to come before changes take effect.↗ shopify.dev
3. 03HulkApps, Selleasy (Logbase) and Swym have each said unauthorized code went out to some stores through their apps in October 2026; Swym paused its app for all merchants on Oct 20.↗ getrevenueshield.com
4. 04Revenue Shield, using heyapps.dev archives, counted 563 apps removed from the App Store since Oct 14, 2026, with 108 later returning (including Selleasy and ReConvert), as of its Oct 27 update; it lists no public reason for most of them.↗ getrevenueshield.com
5. 05Shopify's president said 135 apps were delisted and that most delistings are unrelated to security.↗ shopifyentrepreneurs.beehiiv.com
6. 06Delisting stops new installs but doesn't remove an app, or the code it adds, from stores that already have it.↗ getrevenueshield.com
7. 07Since Oct 20, 2026, storefronts ask customers to confirm before sending them to a website outside the store.↗ changelog.shopify.com
8. 08Logbase says Selleasy was attacked through a legacy internal support tool, a redirect script was injected on Oct 13, 2026, it had an outside security test (Astra Security, Oct 16–20) and Shopify review, and the app was relisted on Oct 27.↗ logbase.io
9. 09Aftersell (Rokt) says an automated attack starting Oct 7 exposed non-sensitive upsell settings from 22 stores, and that no checkout hijacking happened, no shopper or payment data was exposed and no money moved. It says it is working with Shopify to be relisted.↗ linkedin.com