Skip to content

Shopify access control & privilege security checks

Admin roles, standing privileges, permission scopes and policy enforcement — the settings that decide how much damage one compromised account can do.

On Shopify, Black Cat runs 16 checks in this area on every scan. Each one below lists its severity, how to fix it, and the compliance controls it satisfies where a control applies. See what access the Shopify connector needs.

Checks (16)

severity: medium Excessive Admins fix difficulty: easy #

Reduce the number of full-access staff accounts to the minimum necessary

  1. Log in to the Shopify admin as the store owner
  2. Navigate to Settings > Users and permissions
  3. Review the list of staff accounts with full permissions
  4. For each account that does not require full access, click the staff member's name
  5. Under "Permissions", switch from full access to a custom, restricted permission set
  6. Save the updated permissions for each affected staff member

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-312.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Staff Unrestricted Permissions fix difficulty: easy #

Apply least-privilege permissions to staff accounts instead of granting full store access

  1. Log in to the Shopify admin as the store owner
  2. Navigate to Settings > Users and permissions
  3. Click on the flagged staff member's name
  4. Under "Permissions", deselect "Full permissions" if enabled
  5. Enable only the specific permission areas the staff member requires for their role
  6. Save the changes and notify the staff member of their updated access level

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-25.2 HIPAA (SaaS Security) HIPAA-308.a4 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Excessive API Scopes fix difficulty: medium #

Remove unnecessary write permissions from custom app API scopes

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" to open the custom apps section
  4. Select the flagged custom app
  5. Under "Configuration", click "Edit" next to the API scopes
  6. Remove any write scopes that are not required for the app's functionality
  7. Save the changes; the app will need to re-request authorization if scopes are reduced

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 CIS Controls v8 CIS-06.1 NIST CSF 2.0 PR.AA-05 GDPR (SaaS Security) GDPR-28.1 HIPAA (SaaS Security) HIPAA-314.a NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Write Payment Gateways Scope fix difficulty: medium #

Remove write_payment_gateways scope from the custom app to prevent unauthorized payment rerouting

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" and select the flagged custom app
  4. Under "Configuration", click "Edit" next to the API scopes
  5. Uncheck the write_payment_gateways scope
  6. Save the changes and confirm the app still functions correctly without the removed scope

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Write Themes Scope fix difficulty: medium #

Remove write_themes scope unless the app is an authorized theme management tool

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" and select the flagged custom app
  4. Under "Configuration", click "Edit" next to the API scopes
  5. Uncheck the write_themes scope if the app does not require theme editing
  6. Save the changes and verify the storefront has not been modified unexpectedly

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Write Script Tags Scope fix difficulty: medium #

Remove write_script_tags scope to prevent unauthorized script injection on checkout pages

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" and select the flagged custom app
  4. Under "Configuration", click "Edit" next to the API scopes
  5. Uncheck the write_script_tags scope
  6. Review existing script tags via the Admin API to confirm no unauthorized scripts are present

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Write Price Rules Scope fix difficulty: medium #

Remove write_price_rules scope if the app does not require discount code management

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" and select the flagged custom app
  4. Under "Configuration", click "Edit" next to the API scopes
  5. Uncheck the write_price_rules scope
  6. Save the changes and audit existing price rules for unauthorized discount codes

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Write Inventory Scope fix difficulty: medium #

Remove write_inventory scope if the app does not require inventory management

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" and select the flagged custom app
  4. Under "Configuration", click "Edit" next to the API scopes
  5. Uncheck the write_inventory scope
  6. Save the changes and verify inventory levels for unexpected modifications

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Staff No Permissions fix difficulty: easy #

Assign explicit permissions to staff accounts or remove accounts with no assigned role

  1. Log in to the Shopify admin as the store owner
  2. Navigate to Settings > Users and permissions
  3. Click on the flagged staff member's name
  4. Under "Permissions", either assign appropriate permissions for the staff member's role or deactivate the account if unused
  5. If deactivating, click "Remove staff account" to revoke all access
  6. Notify the staff member of any changes made to their account

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.2 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Write Fulfillments Scope fix difficulty: medium #

Remove write_fulfillments scope if the app does not manage order fulfillment

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" and select the flagged custom app
  4. Under "Configuration", click "Edit" next to the API scopes
  5. Uncheck the write_fulfillments scope
  6. Save the changes and audit recent fulfillment activity for unauthorized modifications

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Unauthenticated Write Checkouts Scope fix difficulty: medium #

Remove unauthenticated_write_checkouts scope to prevent unauthorized checkout creation

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click "Develop apps" and select the flagged custom app
  4. Under "Configuration", click "Edit" next to the API scopes
  5. Uncheck the unauthenticated_write_checkouts scope
  6. Save the changes and confirm the Storefront API integration still functions as intended

Vendor docs ↗

Satisfies: ISO 27001:2022 A.5.15 SOC 2 Type II CC6.1 NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: critical Admin Staff MFA Disabled fix difficulty: easy #

Enable two-factor authentication for all admin-level staff accounts immediately

  1. Log in to the Shopify admin as the store owner
  2. Navigate to Settings > Users and permissions
  3. Identify admin staff members without two-factor authentication
  4. Contact each admin staff member and require them to enable 2FA in their account settings
  5. Consider enforcing 2FA organization-wide through Shopify Plus settings if available

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Read All Orders Scope fix difficulty: medium #

Remove the read_all_orders scope if the app does not need access to the full order history

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click Develop apps and select the flagged custom app
  4. Under Configuration, click Edit next to the API scopes
  5. Uncheck the read_all_orders scope and use read_orders for recent orders only
  6. Save the changes and verify the app still functions correctly

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: medium Write Draft Orders Scope fix difficulty: medium #

Remove the write_draft_orders scope if the app does not need to create draft orders

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click Develop apps and select the flagged custom app
  4. Under Configuration, click Edit next to the API scopes
  5. Uncheck the write_draft_orders scope
  6. Save the changes and audit recent draft order activity

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Write Order Edits Scope fix difficulty: medium #

Remove the write_order_edits scope if the app does not need to modify existing orders

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click Develop apps and select the flagged custom app
  4. Under Configuration, click Edit next to the API scopes
  5. Uncheck the write_order_edits scope
  6. Save the changes and review recent order modifications for unauthorized changes

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

severity: high Write Users Scope fix difficulty: medium #

Remove the write_users scope if the app does not need to manage staff accounts

  1. Log in to the Shopify admin as the store owner or staff with app management permissions
  2. Navigate to Settings > Apps and sales channels
  3. Click Develop apps and select the flagged custom app
  4. Under Configuration, click Edit next to the API scopes
  5. Uncheck the write_users scope
  6. Save the changes and audit recent staff account modifications

Vendor docs ↗

Satisfies: NIS2 Directive NIS2-21.i.1 DORA (SaaS Security) DORA-9.2

More Shopify checks

The information on this page is provided for general informational purposes and is believed to be accurate as of its most recent update. Product names, logos, and trademarks are the property of their respective owners and are used for identification purposes only; their use does not imply any affiliation with or endorsement by those owners. Descriptions of third-party applications and of compliance frameworks are based on publicly available documentation and may change over time.

See these checks run on your stack

Start a free 14-day trial — no credit card required.

Start Free Trial